Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated malware campaign targeting WhatsApp users has been observed since February 2026. The attack chain begins with malicious Visual Basic Script files sent via WhatsApp messages, which, when executed, initiate a multi-stage infection process. The malware uses renamed Windows utilities, retrieves payloads from trusted cloud services, and installs malicious MSI packages. The campaign employs social engineering, stealth techniques, and cloud-based payload hosting to establish persistence and escalate privileges on victim systems. The attackers utilize legitimate tools and trusted platforms to reduce visibility and increase the likelihood of successful execution. The final stage involves the delivery of unsigned MSI installers that enable remote access to compromised systems.

This malware campaign exploits WhatsApp as a delivery vector, sending malicious Visual Basic Script (VBS) files to users. Upon execution, the VBS initiates a complex, multi-stage infection chain. The malware uses renamed Windows utilities to evade signature-based detection and downloads additional payloads hosted on trusted cloud platforms, complicating network-based detection. It installs malicious MSI installers that are unsigned, which serve as backdoors providing remote access and persistence on victim machines. The campaign employs social engineering tactics to convince users to execute the initial VBS file, leveraging the trust users place in WhatsApp communications. Privilege escalation is achieved through User Account Control (UAC) bypass techniques, allowing the malware to gain elevated rights without triggering alerts. The use of legitimate Windows tools and trusted cloud services reduces the likelihood of detection by traditional security solutions. The campaign also includes mechanisms for persistence, such as installing MSI packages that execute on system startup or via scheduled tasks. Indicators of compromise include numerous file hashes associated with the VBS and MSI payloads. The attack chain aligns with MITRE ATT&CK techniques including T1566 (Phishing), T1204.002 (User Execution: Malicious File), T1548.002 (UAC Bypass), T1543.003 (Windows Service), T1053 (Scheduled Task), T1055 (Process Injection), and T1078 (Valid Accounts). No CVE or known exploits in the wild are currently associated with this campaign, but its complexity and stealth make it a significant threat to Windows users receiving WhatsApp messages.

Detailed information about WhatsApp malware campaign delivers VBScript and MSI backdoors. Get real-time updates, technical details, and mitigation strategies.

WhatsApp malware campaign delivers VBScript and MSI backdoors - Live Threat Intelligence - Threat Radar | OffSeq.com

WhatsApp malware campaign delivers VBScript and MSI backdoors

Threats Tagged 'cloud-based'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cloud-based'

Lead Pen Test Professional