WhatsApp Malware Injected Code Into Windows Task Scheduler
A new malware campaign leverages financial lures to escalate privileges on Windows systems.
Updated on Oct. 12, 2026 in Cybersecurity
Live Poll
Do you trust that documents received via messaging apps are safe to open?
Researchers identified a malware strain that uses a financial-document lure sent via WhatsApp to compromise Windows systems. The threat actor injects malicious code directly into the Windows Task Scheduler service to achieve high-level system permissions.
Why it matters
By exploiting the Task Scheduler, the malware ensures it runs with LocalSystem privileges, the highest level of access available on a Windows host. This technique allows attackers to maintain persistence and control over the operating system while avoiding detection.
The malware utilizes an NRV2E-compressed wrapper that reconstructs its loader in memory to minimize artifacts on the disk. It further obscures imports, strings, and control-flow paths to evade static and behavioral analysis.
The players
An end-to-end encrypted messaging service owned by Meta that acts as the initial delivery vehicle for the malicious payload.
Windows
The dominant desktop operating system developed by Microsoft that serves as the target platform for this privilege escalation attack.
The details
The attack begins with a deceptive financial-document file sent through WhatsApp, which acts as the delivery vector for the executable. Once active, the malicious payload injects itself into the Windows Task Scheduler—a native service used to automate tasks at specific times or intervals—to gain elevated LocalSystem privileges. This approach allows the malware to operate as a system-level process, effectively bypassing traditional user-mode security restrictions.
The Tech Race
This campaign highlights the persistent cat-and-mouse game between malware authors and operating system security teams. Attackers continue to prioritize abusing native services like the Windows Task Scheduler to mimic legitimate background tasks and avoid detection.
Users should exercise extreme caution when receiving unexpected financial documents through messaging apps like WhatsApp. If an unauthorized task is identified within the Windows Task Scheduler, administrative intervention and system forensic review are recommended.
The takeaway
This malware emphasizes the risks of executing files from messaging platforms regardless of their supposed financial context. Security teams should monitor task-creation logs on the Windows Task Scheduler for suspicious, non-standard entries.
Further reading
Learn more about the latest threat vectors targeting enterprise environments in our Cybersecurity section.
Live Poll
Do you trust that documents received via messaging apps are safe to open?
