Kaspersky Discovers New Malware Campaign Targeting WhatsApp Desktop

An example of a WhatsApp message containing a malicious VBScript file (photo: Kaspersky)

JAKARTA - Kaspersky revealed a new cyber attack campaign that targets WhatsApp Desktop and WhatsApp Web users massively by distributing malicious VBScript files via direct messages on the platform.

Based on its findings, the global cybersecurity company managed to identify victims in various countries and regions, including Malaysia, Brazil, Singapore, Taiwan, and Vietnam, with the largest number of victims in Malaysia.

According to research by Kaspersky Global Research and Analysis Team (GReAT), cyber criminals use WhatsApp accounts that have previously been hacked to distribute malicious attachments.

Messages are sent from contacts in the account, disguised as invoices, bank statements, account statements, payment records, and debt notifications. Once installed, the malware allows remote access to the system.

The execution flow of the attachment follows a multi-stage process on the affected system. Once opened, the file triggers a sequence of scripts on the device.

In short, when the attachment is opened, the file automatically downloads and runs several additional programs from the internet.

These programs then install remote access software on the victim's computer, so that the device can potentially be monitored or controlled by another party without the user's knowledge.

Kaspersky GReAT experts recommend users to:

Be cautious when receiving unexpected attachments via WhatsApp, even if they come from a known contact. Don't open scripts and executable files such as .vbs, .vbe, .exe, .bat, .cmd, .js, and .ps1 unless their authenticity has been verified. Use security solutions on all computers and mobile devices to warn you and prevent any infections.