WhatsApp Malware Campaign Targets Finance Professionals

• •Malware campaign targets finance teams and executives via WhatsApp.
• •Attackers use compromised accounts to spread malicious files disguised as legitimate documents.
• •New evasion techniques include DLL sideloading and BYOVD to bypass security controls.

Quick Heal Technologies Limited has issued a warning about a rapidly evolving malware campaign targeting finance teams, executives, and business users via compromised WhatsApp accounts. The attackers leverage trust by sending malicious files disguised as legitimate business documents, such as 'Financial Report' and 'Account Statement'. The malware spreads initially through Visual Basic Script files and later through ZIP archives containing executables. New tactics include using DLL sideloading and Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass security measures. The campaign has been observed to create urgency by impersonating communications from regulatory bodies like the Reserve Bank of India. Victims may unknowingly open these attachments, leading to potential data breaches and unauthorized access to sensitive systems. The current status indicates ongoing exploitation, with attackers adapting their methods to evade detection.