WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM

What happened

It checks display settings, available storage and memory, CPU (the general-purpose processor at the centre of a computer) characteristics, Event Log records, Registry markers, virtualization indicators, selected System32 DLL reparse points, and the presence of Baidu endpoint-security processes. A WhatsApp-delivered financial-document lure is being used to deploy a sophisticated Windows malware chain that injects code into the Task Scheduler service and executes subsequent payloads with LocalSystem privileges.

The executable acts as an NRV2E-compressed wrapper that reconstructs its malicious loader entirely in memory, limiting obvious artifacts on disk and obscuring imports, strings, and control-flow […] The post WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . cyber security Cyber Security News Malware 4 min.

Read WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM By Mayura Kathir October 12, 2026 Share Facebook Twitter Pinterest WhatsApp A WhatsApp-delivered financial-document lure is being used to deploy a sophisticated Windows malware chain that injects code into the Task Scheduler service and executes subsequent payloads with LocalSystem privileges. The executable acts as an NRV2E-compressed wrapper that reconstructs its malicious loader entirely in memory, limiting obvious artifacts on disk and obscuring imports, strings, and control-flow logic from static inspection. The loader performs extensive host profiling before contacting its command-and-control infrastructure.