Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

Microsoft has identified a malware campaign distributing malicious VBS files via WhatsApp messages to compromise Windows systems.

• •VBS files create hidden folders in C:\ProgramData and drop renamed Windows utilities (curl.exe as netapi.dll, bitsadmin.exe as sc.exe) to evade detection
• •Payloads are fetched from trusted cloud services including AWS S3, Tencent Cloud, and Backblaze B2 using the renamed binaries
• •The malware tampers with UAC settings and modifies registry entries under HKLM\Software\Microsoft\Win to escalate privileges without user interaction
• •Malicious MSI packages including AnyDesk are installed for persistent remote access and data exfiltration

This summary was automatically generated by AI based on the original article and may not be fully accurate.