An ongoing malware campaign is actively targeting WhatsApp users across multiple countries with phishing messages that masquerade as legitimate business documents. The attack leverages fake invoices, order confirmations, and shipping notifications to trick recipients into opening attached VBScript files.
The campaign focuses on social engineering rather than exploiting a software vulnerability, making user awareness critical. The malicious files, once executed, install remote access trojans (RATs) that give attackers control over infected systems.
Technical analysis reveals the VBScript payloads are often disguised as PDF or ZIP attachments. Indicators of compromise include unusual script file extensions and unsolicited messages urging urgent action, such as "download this invoice."
Mitigation relies heavily on user vigilance. WhatsApp users should avoid opening unexpected attachments, especially from unknown contacts, and verify the sender through a secondary channel. Businesses should educate employees about this specific phishing vector. No WhatsApp software vulnerability is involved.
Attribution remains unclear, but the campaign's scale suggests an organized threat actor. The cross-border nature of the attacks complicates takedown efforts, and similar tactics have been used in past email-based phishing operations.