WhatsApp-Delivered Malware on Windows: SYSTEM Injection via PoolParty and BYOVD Driver

Malware distributed via WhatsApp attachments using financial document lures executes an escalation chain that culminates in LocalSystem privileges without exploiting local vulnerabilities, according to a Morphisec analysis published October 12, 2026. The campaign demonstrates how personal messaging channels bypass traditional email security controls, while the combination of PoolParty injection, BYOVD, and DLL side-loading makes detection extremely difficult for security teams.

How the Loader Bypasses Endpoint Defenses

The file Statement-846143734.exe, the initial payload in the chain, is an NRV2E-compressed wrapper that decompresses the loader without writing to disk, according to the Morphisec technical report. Before proceeding, the loader screens the host across eight parameters: display, storage, CPU, event log, registry marker, virtualization indicators, system DLL reparse points, and presence of Baidu processes.

The anti-emulation mechanism relies on 50-millisecond D3D11 timing gates. Two consecutive gates measure system response: a delay on the first destroys the shellcode container, a delay on the second wipes the target PID and payload. The loader also implements eight integrity interpreter variants that protect 176 function entry points against security hooks.

From User to SYSTEM with PoolParty Variant 7

Privilege escalation begins with documented COM auto-elevation techniques through specific CLSIDs, with a fallback mechanism via ShellExecuteW with the runas parameter. Once an elevated token is obtained, the malware enables SeDebugPrivilege and replaces the in-memory copy of ntdll.dll with a clean version, eliminating hooks installed by EDR solutions.

The decisive step occurs with PoolParty Variant 7, an injection technique into the I/O completion thread pool of the Windows Task Scheduler service. The malware writes TP_DIRECT callbacks through the I/O completion queue, completely avoiding the CreateRemoteThread call that most security tools monitor. Task Scheduler runs as LocalSystem: the injected process inherits this token without requiring further escalation, as documented by Morphisec.

"After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process" — Morphisec, cited by The Hacker News

The Deployment Bundle: BYOVD, Vulkan, and WebSocket C2

The injected downloader establishes an HTTP POST connection to 61.18.208.27 on port 8888 and validates the response via magic header 0x0207. The response body contains a reflective loader that performs Huffman decoding and manually maps a Deployment DLL. This component operates on three simultaneous paths: deployment of the GoFly64.sys driver, in-memory execution of the RAT, and writing of the persistent Vulkan package.

GoFly64.sys is a signed Chinese network filter driver that the malware abuses in Bring Your Own Vulnerable Driver mode. It exposes IOCTL 0x12227A to receive PIDs of Baidu processes and terminate them from ring 0, neutralizing the Chinese vendor's endpoint defenses. Simultaneously, the persistent package is written to C:\Program Files\Common Files\: vulkaninfo-64.exe, a legitimate Intel-signed binary, loads the malicious vulkan-1.dll from the application directory before searching System32. A system scheduled task named USOPrivate Kit launches the executable at boot with SYSTEM privileges, completing the persistence chain.

The final RAT, identified as VulcanRAT207.A, establishes a WebSocket v13 connection to the same C2 address 61.18.208.27:8888. Documented capabilities include system reconnaissance, file operations, shell execution, clipboard modification, account creation and password changes, Event Log access, remote desktop, and screen capture.

Immediate Actions for Security Teams

Security teams must immediately implement active hunting for the specific indicators of compromise documented by Morphisec: the scheduled task named USOPrivate Kit, the presence of Vulkan files in C:\Program Files\Common Files\, and outbound connections to 61.18.208.27 on port 8888. The three SHA-256 hashes provided in the report — 0c418989bbc836208a087dee8fd64210f58909dddf736bc94769c269f65c26eb, be740b05caead2fa4521f42da0653a10f53029df5455ebafe4701ab3d41afdf9, and 6833b1946ac219cf6ddf6cfbde1f81352b12d9125c8735961b5256216c4fdc49 — must be added to detection system blocklists.

The technical chain highlights a critical defense gap: traditional email security controls do not intercept threats delivered via consumer messaging platforms like WhatsApp. Organizations must extend SOC visibility to these channels or implement access policies that restrict the use of personal messaging services on corporate endpoints. Detection of PoolParty Variant 7 additionally requires monitoring of I/O completion thread pool operations, which are anomalous for legitimate Task Scheduler processes.

Attribution and Dossier Limitations

Proofpoint has documented campaigns with Vulkan-themed files associated with the Chinese-language TA4922 cluster, but attribution of this specific intrusion to the same actor is not confirmed in available sources. The dossier does not specify the exact campaign start date, the number of confirmed victims, targeted sectors, nor the precise WhatsApp delivery method — direct contact, groups, or business API.

No infrastructure overlaps emerge linking this campaign to intrusions previously attributed to the same cluster. The nature of any exfiltrated data is not declared in the sources, and the brief does not document specific remedial measures released by security vendors or Microsoft.

Why This Campaign Changes the Defense Perimeter

The VulcanRAT207.A chain demonstrates that threat actors have internalized the most sophisticated evasion techniques: they do not exploit zero-day vulnerabilities, but abuse legitimate Windows mechanisms and signed binaries to make every stage of the attack technically plausible. PoolParty injection transforms a user process into SYSTEM without anomalies detectable by most EDRs; BYOVD with a Chinese driver exploits automatic trust in code-signing certificates; DLL side-loading of Vulkan utilities exploits the perceived legitimacy of Intel-signed binaries.

The enterprise defense perimeter is built to intercept malicious email and block suspicious attachments. When the vector becomes a WhatsApp message on a personal device connected to the same Windows session, that perimeter ceases to exist. The question for CISOs is no longer whether to update antispam rules, but whether the SOC has visibility into the channels users actually use to receive documents.

Sources

• https://gbhackers.com/whatsapp-delivered-malware/amp/
• https://gbhackers.com/whatsapp-delivered-malware/
• https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html
• https://www.morphisec.com/blog/copy-of-how-to-stop-ransomware-before-execution/
• https://www.stepsecurity.io/blog/subql-ecosystem-compromised
• https://www.resecurity.com/blog/article/session-cookie-authentication-bypass-predictable-signing-secret-enableds-account-impersonations
• https://github.com/subquery/subql/issues/3047
• https://github.com/EmergingThreats/threatresearch/commit/f7721c28c9f30b905a3ec0c66a0eec0edffec8cb
• https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html

Information verified against cited sources and current as of publication.

Sources