WhatsApp Phishing Attack Uses Fake Documents to Deploy RAT

A WhatsApp phishing attack is targeting businesses with fake document requests that lead to malware infections. Researchers say attackers are posing as business contacts and sending messages that appear to contain legitimate files.

Instead of delivering invoices or contracts, the campaign installs ConnectWise RAT, a remote access tool that allows attackers to take control of infected systems. The operation highlights how cybercriminals continue shifting phishing activity away from email and onto trusted messaging platforms.

Attackers Impersonate Business Contacts

The WhatsApp phishing attack begins with a message that appears to come from a legitimate business contact. Victims receive requests related to invoices, purchase orders, quotations, or other routine documents.

The messages often look professional and relevant to daily business activities. This helps attackers build trust before directing targets to download a file.

Researchers found that the campaign relies heavily on social engineering rather than software vulnerabilities. Victims are persuaded to launch the malicious files themselves.

Fake Documents Lead to Malware Installation

The attackers use file-sharing links that appear to host business documents. Once victims access the content, they receive files designed to start the infection process.

The campaign ultimately deploys ConnectWise RAT on compromised systems. Although ConnectWise software has legitimate administrative uses, threat actors frequently abuse remote access tools because they blend into normal network activity.

After installation, attackers can interact with the infected device remotely and perform additional actions.

Remote Access Creates Significant Risks

The WhatsApp phishing attack gives attackers more than simple access to files. A successful infection can provide long-term control over the affected computer.

Threat actors may collect sensitive documents, harvest credentials, monitor user activity, or deploy additional malware. In some cases, remote access tools serve as the first stage of larger attacks that later involve data theft or ransomware.

Because the malware uses a legitimate remote administration platform, security teams may face additional challenges when identifying suspicious activity.

Messaging Platforms Become a Growing Attack Vector

Cybercriminals increasingly use messaging applications to deliver malicious content. Many employees view messages received through WhatsApp as more trustworthy than traditional phishing emails.

Attackers take advantage of that perception by disguising malware as routine business communications. As organizations adopt messaging platforms for daily collaboration, threat actors gain new opportunities to reach potential victims.

Researchers expect similar campaigns to continue targeting businesses through messaging services.

Organizations Should Verify File Requests

Security experts recommend verifying unexpected document requests before downloading files or opening links. Employees should confirm requests through a separate communication channel whenever possible.

Organizations should also educate staff about phishing attacks that originate through messaging applications. Security awareness training remains one of the most effective defenses against social engineering campaigns.

Monitoring remote access software and restricting unnecessary installations can further reduce risk.

Conclusion

The WhatsApp phishing attack demonstrates how attackers are adapting familiar social engineering tactics to modern communication platforms. By disguising malware as routine business documents, the campaign increases the likelihood that victims will install malicious software themselves. As messaging-based phishing continues to grow, organizations must treat unexpected file requests on WhatsApp with the same caution they apply to suspicious emails.