WhatsApp Malware Chain Injects Code Into Windows Task Scheduler for SYSTEM Access
A financial document lure delivered via WhatsApp deploys malware that hijacks the Windows Task Scheduler to execute payloads with LocalSystem privileges, bypassing standard security checks.
Key points
- The malware uses a ZIP archive disguised as a financial statement to deliver an NRV2E-compressed executable wrapper.
- Attackers exploit PoolParty Variant 7 to inject malicious callbacks into the Task Scheduler service, inheriting SYSTEM authority.
- Morphisec identified the activity, noting the use of a legitimately signed GoFly64.sys driver for defense evasion.
A sophisticated malware campaign delivered through WhatsApp messages is exploiting the Windows Task Scheduler to achieve persistent LocalSystem privileges, according to a report by GBHackers. The attack chain begins with a deceptive lure and culminates in deep system compromise through advanced process injection techniques that bypass traditional monitoring.
The initial delivery mechanism involves a ZIP archive labeled as a financial statement, which contains an executable named Statement-846143734.exe, as identified by security firm Morphisec in a report shared with GBHackers. This executable functions as an NRV2E-compressed wrapper that reconstructs its malicious loader entirely in memory, significantly limiting detectable artifacts on the disk and obscuring import structures from static analysis tools.
Technical Execution and Privilege Escalation
Before contacting command-and-control infrastructure, the loader performs extensive host profiling to assess the environment, checking display settings, storage capacity, CPU characteristics, and Event Log records. It also looks for Registry markers, virtualization indicators, specific System32 DLL reparse points, and the presence of Baidu endpoint-security processes, using timing gates and anti-hook checks to disrupt execution in sandboxed or emulated environments.
If the host passes these checks, the malware attempts privilege elevation using COM auto-elevation techniques, with ShellExecuteW utilizing the runas verb as a fallback method. Upon obtaining an elevated token, it enables SeDebugPrivilege and restores a clean copy of ntdll.dll to weaken user-mode monitoring capabilities, preparing the system for deeper infiltration of critical Windows services.
Task Scheduler Injection and Payload Deployment
The critical phase of the attack involves PoolParty Variant 7, a process-injection technique that inserts a malicious TP_DIRECT callback into a target process’s Windows thread pool via an I/O completion queue, rather than using conventional CreateRemoteThread methods. Because the Task Scheduler service runs as LocalSystem, the injected downloader inherits this high-level authority, allowing subsequent components to execute without needing additional local privilege-escalation exploits.
The downloader then sends an HTTP POST request to the IP address 61[.]18[.]208[.]27 on port 8888, validating a custom response header before retrieving an in-memory deployment bundle. This bundle reflectively loads a deployment DLL that coordinates further defense evasion, payload execution, and persistence mechanisms within the compromised system environment.
Who Is Affected
Windows users who receive and open unsolicited financial documents via WhatsApp are at risk of infection, particularly those running systems without robust endpoint detection and response solutions. The malware’s ability to bypass static inspection and evade virtualization indicators suggests it targets sophisticated environments, potentially impacting enterprises that rely on standard sandboxing for threat analysis.
What should you do?
Security teams should monitor for unusual Task Scheduler activity and investigate any unexpected process injections or callbacks in Windows thread pools. Administrators should review logs for connections to the identified command-and-control IP address and check for the presence of the GoFly64.sys driver, which is abused through the bring-your-own-vulnerable-driver model in this campaign.
What to do and how to stay safe: WhatsApp
- Monitor Windows Event Logs for unexpected Task Scheduler modifications or new tasks created by suspicious processes.
- Block network traffic to the identified command-and-control IP address 61[.]18[.]208[.]27 on port 8888.
- Investigate the presence of the GoFly64.sys driver and remove it if found, as it is being abused for defense evasion.
- Educate users to avoid opening unsolicited financial documents received via messaging applications like WhatsApp.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does the malware achieve SYSTEM privileges?
The malware uses PoolParty Variant 7 to inject code into the Windows Task Scheduler service, which runs as LocalSystem, allowing the injected downloader to inherit SYSTEM authority.
What is the initial lure used in this attack?
The attack begins with a ZIP archive disguised as a financial statement, containing an NRV2E-compressed executable named Statement-846143734.exe.
Which driver is abused in this campaign?
The deployment DLL loads GoFly64.sys, a legitimately signed driver abused through the bring-your-own-vulnerable-driver model to evade detection.
