Warning Issued Over Malware-Spreading WhatsApp Messages

Users of WhatsApp Web and WhatsApp Desktop are advised to remain vigilant after cybersecurity researchers discovered malware spreading through direct messages on the platform.

Kaspersky’s Global Research and Analysis Team (GReAT) revealed the cyberattack campaign in June 2026. In its operation, attackers use compromised WhatsApp accounts to send malicious VBScript files to the victims’ contacts.

Kaspersky noted that victims have been identified in several countries and regions, including Malaysia, Brazil, Singapore, Taiwan, and Vietnam. Malaysia has been identified as the country with the highest number of victims. Meanwhile, the use of various languages in file names indicates that the perpetrators are also targeting users in various regions, particularly Europe.

According to Kaspersky, messages containing dangerous attachments are sent from contacts already known to the victim. This method increases the likelihood of the recipient opening the file, as they assume the message originates from a trusted person.

“In this attack scheme, attackers exploit the trust within the messaging platform by using compromised WhatsApp accounts to send malicious attachments that appear to come from known contacts, making recipients more likely to interact with them,” said Kaspersky GReAT Security Researcher, Fareed Radzi, in a written statement cited by CNBC Indonesia.

The perpetrators disguise the malicious files as common business documents used daily. Kaspersky found several examples of file names resembling invoices, bank reports, account statements, payment records, and even debt notifications.

Furthermore, the file names are created in various languages, such as English, Portuguese, French, German, and Malay, to reach a wider target audience. The VBScript samples used are even equipped with comments and metadata designed to resemble official Microsoft Windows Update components to avoid suspicion.

Fareed explained that once the file is opened, the malware executes a series of infections in stages. The file silently downloads and executes additional malicious components from external servers controlled by the attackers.

“The file names are carefully disguised as routine business documents, such as invoices and payment notices, and are localised in various languages to support widespread targeting. Once opened, the file triggers a multi-stage infection chain that silently retrieves and executes additional malicious components from external infrastructure,” he said.

Kaspersky explained that the initial stage of infection begins when the script creates a working directory in the C:folder. Subsequently, the malware downloads additional scripts from external infrastructure and executes them via the Windows Script Host.

The subsequent scripts then perform various activities on the victim’s system and download compressed archives containing remote monitoring and management software. Once installed, the malware allows attackers to gain remote access to the victim’s system using administrative capabilities commonly used for technical support and IT management.

To avoid similar attacks, Kaspersky urges users not to indiscriminately open attachments received via WhatsApp, even if the message appears to come from a known contact.

Users are also advised not to open files with .vbs, .vbe, .exe, .bat, .cmd, .js, or .ps1 extensions without verifying their authenticity. Additionally, the use of security solutions on computers and mobile devices is considered essential to help detect and block malware infection attempts.