WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM
WhatsApp-delivered fake financial statement drops VulcanRAT207.A, gaining SYSTEM via Task Scheduler injection, BYOVD, and DLL side-loading.
Morphisec documents a malware chain delivered via WhatsApp ZIP that unpacks in memory, profiles the host, elevates via COM auto-elevation, and uses PoolParty Variant 7 thread-pool injection into the Task Scheduler service to run as SYSTEM. It abuses the signed GoFly64.sys driver to kill Baidu endpoint security processes from kernel mode, persists via a USOPrivate Kit scheduled task and vulkaninfo-64.exe/vulkan-1.dll side-loading, and establishes a WebSocket RAT (VulcanRAT207.A) to 61.18.208.27:8888. Possible links to TA4922 Vulkan-themed campaigns are noted but unconfirmed.
65