WhatsApp Attacks—Microsoft Shares Warning 3 Billion Users Must Heed

[webmaster]

There is no doubt at all that the 3.3 billion estimated active users of the WhatsApp end-to-end encrypted messaging service need to be on high alert right now. As Meta confirms that some iPhone users have been advised to uninstall the app, redownload and log back in following a spyware campaign, Microsoft has issued an additional security warning that users cannot afford to ignore. As these attack methods become known amongst the cybercriminal classes, the target base will spread from high-value to, well, just about anyone who finds themselves on the end of phishing attacks already.Here’s what you need to know and, critically, do to protect yourself and your data.

Microsoft Confirms WhatsApp Malware Attack
The Microsoft Defender Security Research team has published a report detailing a dangerous malware campaign, which commenced February 26, using WhatsApp to deliver malicious Visual Basic Script files that start a multi-stage attack chain. “It uses renamed Windows utilities to blend into normal system activity, retrieves payloads from trusted cloud services such as AWS, Tencent Cloud, and Backblaze B2, and installs malicious Microsoft Installer packages to maintain control of the system,” the report warned. Yes, we are talking phishing initially, with those VBS files delivered via WhatsApp messages that exploit user trust. Read the report for the full technical details, but the takeaway is that this attack can leave your Windows environment compromised by threat actors with persistent remote access to your data, thanks to the backdoor it installs. Such phishing attacks pose an ongoing, clear and present danger to all messaging app users, including WhatsApp.

“The attack chain here is built entirely around trust towards tools, cloud services and messaging platforms,” Yagub Rahimov, CEO of Polygraf AI, said, adding that “infrastructure defenders are conditioned to allow, not inspect. Nothing in this chain looks wrong until it's too late.” And Rahimov argued that “WhatsApp makes it worse.” The reasoning being that, for most organizations at least, “the threat perimeter expanded the moment employees started using personal messaging apps on work devices. Most security stacks haven't caught up.”