TLDR Tech / InfoSec
Microsoft Warns of WhatsApp Attachments Spreading Backdoor on Windows PCs
Microsoft Defender researchers warned of an active campaign since late February delivering VBS files via WhatsApp that chain through renamed LOLBins (curl.exe as netapi.dll, bitsadmin.exe as sc.exe), pull second-stage payloads from AWS S3, Tencent Cloud, and Backblaze B2, disable UAC via registry modification, and install unsigned remote access tools such as AnyDesk.msi to establish persistent backdoor access.
Read the full story