Microsoft Details WhatsApp-Delivered VBS Campaign Using UAC Bypass
Summary
Microsoft says a campaign active since late February 2026 uses WhatsApp-delivered VBS files, renamed Windows utilities and cloud-hosted payloads to alter UAC and registry settings and install unsigned MSI packages for persistent remote access.
Key points
- Microsoft says the campaign began in late February 2026; the lures used to persuade victims to run the VBS files are unknown.
- The VBS files create hidden folders in C:ProgramData and drop renamed Windows utilities, including curl.exe as netapi.dll and bitsadmin.exe as sc.exe.
- The renamed utilities retrieve auxiliary VBS payloads from AWS S3, Tencent Cloud and Backblaze B2.
- Microsoft says the malware tampers with UAC settings, repeatedly attempts to launch cmd.exe with elevated privileges, and modifies registry entries under HKLMSoftwareMicrosoftWin.
- Unsigned MSI packages, including AnyDesk, are deployed for persistence and remote access; Microsoft says attackers may use this access to exfiltrate data or deploy more malware.
Article Details
- Attack Vectors
- Malicious VBS files are delivered through WhatsApp messages; the lure used to persuade recipients to execute them is unknown.
- When executed, the VBS scripts create hidden folders under C:\ProgramData and drop renamed Windows utilities, including curl.exe as netapi.dll and bitsadmin.exe as sc.exe.
- The renamed utilities download auxiliary VBS payloads hosted on AWS S3, Tencent Cloud, and Backblaze B2.
- The activity modifies UAC settings and registry entries under HKLM\Software\Microsoft\Win, repeatedly attempts to launch cmd.exe with elevated privileges, and installs unsigned MSI packages.
- The MSI packages include AnyDesk, which the attackers use to maintain remote access. The article says this access can enable data exfiltration or further malware deployment.
- Defensive Notes
- Treat unexpected VBS files delivered through WhatsApp as suspicious; the article does not identify the campaign's specific lures.
- Monitor for hidden directories under C:\ProgramData and renamed copies of curl.exe or bitsadmin.exe, particularly when used to retrieve scripts from cloud storage.
- Investigate unexpected changes to UAC settings or registry entries under HKLM\Software\Microsoft\Win, repeated attempts to launch cmd.exe with elevated privileges, and unsigned MSI installations.
- Review unexpected AnyDesk installations or activity for unauthorized persistent remote access.
MITRE ATT&CK
T1036 · MasqueradingThe attackers rename curl.exe as netapi.dll and bitsadmin.exe as sc.exe to make the utilities blend in.T1059.003 · Windows Command ShellThe malware repeatedly attempts to launch cmd.exe with elevated privileges.T1059.005 · Visual BasicThe campaign uses VBS scripts to create hidden folders and initiate the infection chain.T1105 · Ingress Tool TransferThe renamed utilities download auxiliary VBS payloads hosted on AWS S3, Tencent Cloud, and Backblaze B2.T1112 · Modify RegistryThe campaign modifies registry entries under HKLM\Software\Microsoft\Win.T1204.002 · Malicious FileThe infection starts when a recipient executes a malicious VBS file delivered through WhatsApp.T1219 · Remote Access ToolsThe attackers install AnyDesk to maintain persistent remote access to victim systems.T1548.002 · Bypass User Account ControlThe attackers tamper with UAC settings and repeatedly attempt to launch cmd.exe with elevated privileges to bypass UAC.T1564.001 · Hidden Files and DirectoriesThe scripts create hidden folders under C:\ProgramData.
Vendors
Amazon Web ServicesThe attackers rename legitimate Windows utilities, retrieve secondary payloads from AWS, Tencent Cloud, and Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) toBackblazeattackers rename legitimate Windows utilities, retrieve secondary payloads from AWS, Tencent Cloud, and Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) to gainMicrosoftMicrosoft warns of a new campaign that uses WhatsApp messages to distribute malicious Visual Basic Script (VBS) files that initiate a multi-stage infection chain.Tencent CloudThe attackers rename legitimate Windows utilities, retrieve secondary payloads from AWS, Tencent Cloud, and Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) to
Products
AnyDeskand Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) to gain persistent, elevated remote access.AWS S3Secondary payloads are downloaded from cloud services including AWS S3, Tencent Cloud, and Backblaze B2 using the renamed binaries.Backblaze B2rename legitimate Windows utilities, retrieve secondary payloads from AWS, Tencent Cloud, and Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) to gainMicrosoft WindowsThe attackers rename legitimate Windows utilities, retrieve secondary payloads from AWS, Tencent Cloud, and Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) toTencent CloudThe attackers rename legitimate Windows utilities, retrieve secondary payloads from AWS, Tencent Cloud, and Backblaze B2, tamper with UAC and registry settings, and install unsigned MSI packages (including AnyDesk) toWhatsAppMicrosoft warns of a new campaign that uses WhatsApp messages to distribute malicious Visual Basic Script (VBS) files that initiate a multi-stage infection chain.
Tools
bitsadminThe scripts create hidden folders in C:ProgramData and drop renamed Windows utilities like curl.exe and bitsadmin.exe to blend in.cmd.exe“It continuously attempts to launch cmd.exe with elevated privileges, retrying until UAC elevation succeeds or the process is forcibly terminated, modifying registry entries under HKLMSoftwareMicrosoftWin, and embeddingcurlThe scripts create hidden folders in C:ProgramData and drop renamed Windows utilities like curl.exe and bitsadmin.exe to blend in.