Microsoft: Cyberattacks via WhatsApp – Malware Distribution Campaign

Microsoft is warning of a new cyberattack campaign using WhatsApp messages to spread malware. The campaign, which began in late February 2026, targets Windows systems.

Attackers are distributing malicious Visual Basic Script (VBS) files via WhatsApp. When executed, these files create hidden folders in the C:\ProgramData directory and store renamed versions of Windows utilities such as curl.exe and bitsadmin.exe.

The malware uses trusted cloud services, such as AWS, Tencent Cloud, and Backblaze B2, to retrieve payloads and install malicious MSI packages, thus ensuring its persistent presence on the system.

Microsoft urges users to be especially careful with files received via WhatsApp and to ensure that their systems are up to date with the latest security updates.