WhatsApp Malware Campaign Delivering VBS Payloads and MSI Backdoors

Executive Summary In late February 2026, Microsoft Defender Experts detected a sophisticated attack campaign leveraging WhatsApp to distribute malicious Visual Basic Script (VBS) files to Windows user