WhatsApp and Signal Users Targeted in Rising Hacker Campaigns

Users of popular messaging apps WhatsApp, Facebook Messenger, and Signal are facing an increasing number of sophisticated, targeted attacks, according to recent warnings from Microsoft and the UK’s National Cyber Security Centre (NCSC). These campaigns employ social engineering tactics to deliver malware, potentially granting attackers long-term access to compromised devices.

Malware Campaign Details

Microsoft security experts detected a WhatsApp campaign in late February utilizing malicious Visual Basic Script (VBS) files. Attackers are leveraging social engineering to trick users into executing these files. Once activated, the scripts initiate a multi-stage infection process designed to establish persistence and enable remote access to the victim’s system [Microsoft Security Blog].

The attack is designed to blend in with normal system activity by renaming legitimate Windows utilities before downloading malicious payloads from trusted cloud services like AWS, and Tencent. This allows attackers to install malicious Microsoft Installer (MSI) packages, potentially escalating privileges and gaining administrative control over the compromised device [Microsoft Security Blog].

NCSC Warnings and International Collaboration

The UK’s NCSC issued a security alert on March 31, echoing concerns about the rise in targeted attacks against messaging app users. The NCSC, along with international partners, has released guidance for individuals at risk [Infosecurity Magazine] and [NCSC PDF Warning]. The alert covers WhatsApp, Messenger, and Signal.

Mitigation and Prevention

Microsoft recommends blocking the execution of script hosts in untrusted paths and actively monitoring for renamed or hidden Windows utilities being executed [IT Pro]. Users should exercise caution when opening attachments or clicking links received through messaging apps, even from known contacts.

Key Takeaways

• WhatsApp and Signal users are being targeted by increasingly sophisticated malware campaigns.
• Attackers are using social engineering and malicious scripts to gain access to devices.
• The campaigns leverage trusted platforms and tools to evade detection.
• Users should be vigilant about opening attachments and clicking links from unknown sources.