The “Statement of Account” on WhatsApp is a program

Since early 2026, people in India and several other countries have been receiving files on WhatsApp from contacts they know: a supplier, a customer, a colleague. The files have names like Statement of Account, Outstanding Payment List, RBI.zip or MCA.zip. Often there is no message, only the attachment.

They aren’t documents. They are scripts, programs and disk images that install remote-access software on a Windows PC, take over the WhatsApp Web session on it, and send the same file to the victim’s contacts. CERT-In, the Indian Cybercrime Coordination Centre (I4C), Kerala Police, Microsoft, Kaspersky and Quick Heal have all published warnings. On 10 October, Kerala Police reported a fresh surge over the previous ten days.

This post explains how the campaign works, why the file type matters more than the sender, and what individuals and IT teams can do about it.

What has been reported

The campaign has changed shape several times. The public reporting, in order:

Late February 2026. Microsoft observes VBScript (.vbs) files sent over WhatsApp. The scripts hide in C:\ProgramData, use renamed copies of built-in tools such as curl.exe and bitsadmin.exe, pull later stages from AWS S3, Tencent Cloud and Backblaze B2, and finish by installing MSI packages, including AnyDesk, for remote control. Microsoft published its analysis on 31 March.
22 June. Kaspersky reports a VBScript campaign that silently installs a preconfigured ManageEngine Endpoint Central agent, a legitimate remote management tool, connected to the attacker’s servers. Victims are in 11 countries, including India; 80% are in Malaysia. File names are localised into Malay, Portuguese, French and German.
25 June. CERT-In issues advisory CICA-2026-3534, warning WhatsApp Web and Desktop users that compromised accounts are distributing the malware.
4 July. Kerala Police warn businesses that hijacked customer and supplier accounts are sending script files disguised as account statements to accounts staff.
7 August. The Ministry of Home Affairs says I4C has found ZIP archives containing a Windows executable and a DLL. Opened on Windows, they hijack the active WhatsApp Web session and resend the file to contacts and groups, often asking for it to be forwarded to the finance manager. The ministry says more than 10,000 people have been protected so far, with the malware’s servers blocked through the Sahyog portal, and cases reported from Delhi, Gujarat, Maharashtra and Rajasthan.
25 August. I4C warns CFOs and finance teams about the “Boss Scam”. Once an executive’s WhatsApp is under the attacker’s control, or an attacker’s number is saved under the CEO’s name, staff receive urgent instructions to pay mule accounts.
8 September. Quick Heal reports the latest delivery method: .img and .vhd disk images that mount as a drive when double-clicked. The program inside sideloads a malicious DLL, loads a vulnerable signed driver to disable antivirus, then installs Endpoint Central or a backdoor such as ValleyRAT. Some lures impersonate the RBI and the Ministry of Corporate Affairs.
10 October. Kerala Police report the messages spreading across the state, again impersonating the RBI and MCA.

Kaspersky assesses, with low confidence, that the operator is Chinese-speaking. No public report has tied the campaign to a named group.

Why it works

None of the techniques are new. The campaign works because of who appears to send the file and where it lands.

The sender is real. The message comes from an account the recipient already trusts, because that account’s owner is a victim too. “Check who sent it” doesn’t help.
The PC is the target. The malware runs on Windows. It relies on WhatsApp Desktop or WhatsApp Web being open on the same machine that handles invoices, banking portals and saved passwords.
Windows hides the extension. By default, File Explorer hides known file extensions, so a script or program with a document-style name and icon looks like a document.
The final tool is legitimate. Endpoint Central and AnyDesk are commercial software. Security tools that look for malware won’t necessarily flag an administration agent, especially after a vulnerable driver has been used to switch them off.
It spreads itself. Each infected PC uses its WhatsApp Web session to send the file on to more contacts and groups.

The file types that matter

Real statements are almost always PDFs, spreadsheets or images. Published reports on this campaign name .vbs scripts, ZIP archives, and .img and .vhd disk images. .iso and .bat files belong in the same group, and you should treat them the same way.

Extension	What it actually is	Link to this campaign
`.vbs`, `.vbe`	A script run by Windows Script Host	First stage in the Microsoft, Kaspersky and CERT-In reports
`.zip` with `.exe` and `.dll`	A program that loads a malicious library placed next to it (DLL sideloading)	The I4C reports: `RBI.zip`, `MCA.zip`, `Statement of Account.zip`
`.img`, `.vhd`	A disk image. Double-clicking mounts it as a new drive with the program inside	Quick Heal, September 2026
`.iso`	A disk image that Windows mounts on double-click, exactly like `.img`	Not named in the published reports, but it works the same way
`.bat`, `.cmd`	A batch script that runs commands	On Kaspersky’s list of types never to open unverified. The SORVEPOTEL WhatsApp worm in Brazil used one
`.lnk`	A shortcut that can launch any command	SORVEPOTEL used one to start its batch script
`.js`, `.ps1`, `.hta`, `.msi`	Scripts and installers	The same family. Microsoft saw MSI packages as the final stage

Disk images are popular with attackers for a reason. After Microsoft began blocking macros in Office files downloaded from the internet in 2022, Proofpoint measured macro-based campaigns falling by about 66% while ISO use rose more than 150%. For a time, files inside a mounted ISO also lost the “Mark of the Web”, the tag that tells Windows a file came from the internet. Microsoft fixed that in November 2022 (CVE-2022-41091). Windows now warns more often, but a warning is easy to click through when the file came from someone you know.

What happens after the file is opened

The script or program creates a hidden working folder, for example under C:\Users\Public\Documents, and downloads more stages from cloud storage.
It tries to turn off the UAC consent prompt by setting ConsentPromptBehaviorAdmin to 0, retrying until it succeeds.
Newer variants load a legitimately signed but vulnerable driver to disable security software, a technique known as bring your own vulnerable driver (BYOVD).
It installs a remote management agent or backdoor, password-protected so it’s hard to remove.
The attacker collects saved browser passwords and financial data, and uses the WhatsApp Web session to send the file to the victim’s contacts.
With control of an owner’s or executive’s WhatsApp, the attacker messages finance staff with urgent payment instructions.

The loss is usually the paymentThe malware gives the attacker a trusted identity. The money moves when someone in accounts follows an instruction that appears to come from their boss or a regular supplier.

What everyone should do

Don’t open a file because of who sent it. Open it because you were expecting it. If you weren’t, call the sender on a number you already have.
Look at the extension. A statement should be .pdf, .xlsx or an image. If it’s .zip, .vbs, .bat, .iso, .img, .vhd, .exe or anything you don’t recognise, don’t open it.
Turn on file extensions in Windows. In File Explorer, choose View, then Show, then File name extensions.
Check WhatsApp’s linked devices. On your phone, open Settings, then Linked devices, and log out of anything you don’t recognise.
Never pay on a WhatsApp instruction alone. Kerala Police put it plainly: fund transfers need an independent verification step.

What IT and security teams should change

Awareness helps, but this campaign is designed to get past it. These controls stop the file running even when someone double-clicks it.

Show extensions everywhere. Turn off “Hide extensions for known file types” through Group Policy or your device management tool.
Stop scripts running on double-click. Associate .vbs, .vbe, .js, .jse, .wsf and .hta with Notepad, or disable Windows Script Host where nobody needs it. Most office and finance PCs don’t.
Stop disk images mounting on double-click. Few users need to open ISO files. Remove or restrict the Mount action for .iso, .img, .vhd and .vhdx on standard workstations.
Turn on the relevant Microsoft Defender attack surface reduction rules. In particular: block execution of potentially obfuscated scripts, block JavaScript or VBScript from launching downloaded executable content, and block abuse of exploited vulnerable signed drivers. Keep Microsoft’s vulnerable driver blocklist enabled.
Block execution from user-writable folders. Use App Control for Business (WDAC) or AppLocker to stop programs running from Downloads, C:\Users\Public and C:\ProgramData on machines that don’t need it.
Know which remote management tools you run. Alert on any RMM agent you didn’t deploy, including Endpoint Central and AnyDesk. If you use one yourself, alert on agents enrolled to a server that isn’t yours.
Watch for UAC tampering and renamed tools. A change to ConsentPromptBehaviorAdmin on a workstation deserves an alert. So does a renamed curl.exe or bitsadmin.exe: Microsoft notes they keep their original file name in their metadata.
Remove local admin rights from finance PCs, and where you can, keep WhatsApp Web off the machine used for banking.
Write the payment rule down. A new beneficiary, changed bank details or an urgent transfer requested over a messaging app is confirmed by calling a number already on file, never one given in the message.

If someone has already opened one

Disconnect the PC from the network: turn off Wi-Fi or unplug the cable. Don’t forward the file to anyone to “check it”.
From the phone, log out of all WhatsApp linked devices, and tell contacts not to open files sent from that number.
From a different, clean device, change the passwords that were saved in the PC’s browser, starting with email, banking and accounting systems. Turn on two-factor authentication where it’s off.
Call your bank if payment details may have been seen or a transfer has been made.
Look for remote management agents, new services and scheduled tasks. Because newer variants disable antivirus, a clean scan doesn’t prove the PC is clean. Reinstalling Windows is the safer option.
Report it to the national cybercrime helpline on 1930 or at cybercrime.gov.in. Organisations covered by CERT-In’s April 2022 directions must also report qualifying incidents to CERT-In within six hours.

The “Statement of Account” on WhatsApp is a program

What has been reported

Why it works

The file types that matter

What happens after the file is opened

What everyone should do

What IT and security teams should change

If someone has already opened one

Sources

Keep reading.

Security reviews that don’t block releases

Your vulnerability backlog isn’t a to-do list

Threat modeling in 45 minutes: a format engineers actually use

Know where you stand.