Cybersecurity · October 19, 2026 · ComputerKing Team

"ComputerKing Computer ER" Radio Show: Got a "Financial Document" ZIP on WhatsApp? Don't Open It — One Click Can Hand Over Your Whole PC

A WhatsApp ZIP pretending to be a financial document hides a program called Statement.exe. Open it and attackers can end up running at SYSTEM level on your PC. Verify unexpected files through a separate channel — and never run a .exe that arrived as a "document".

Key Takeaways

• A new malware campaign reported in mid-October 2026 spreads through WhatsApp: a ZIP archive with a financial-document pretext contains an executable called `Statement.exe`. Opening it starts a multi-stage infection chain.
• The chain tries to gain elevated privileges, then injects code into the Windows Task Scheduler service host. Because Task Scheduler runs as LocalSystem, later stages inherit SYSTEM-level authority — the highest local privilege tier — without needing another privilege-escalation exploit.
• The final payload, named VulcanRAT207.A, is a remote access trojan: it can collect system data, run commands, manage files, capture screenshots, record keystrokes, create or change local accounts, and download more payloads. A scheduled task restarts it with SYSTEM privileges after a reboot, and a signed driver is used to try to terminate selected security processes.
• This matters for Hong Kong businesses because staff routinely receive invoices, statements, tax files and payment documents through messaging apps. A familiar-looking sender is not proof of safety: verify unexpected files through a separate channel before opening them.
• If you opened such a file: disconnect from the network, do not log in to banking or email, do not back up to USB yet, and get professional cleanup. A standard antivirus scan may not fully remove a SYSTEM-level infection; a clean system reinstall is sometimes the only safe option.

Show Transcript

Opening

May: Hello everyone, welcome to *ComputerKing Computer ER*! I'm your host, May! Today's episode is a warning — and it starts with something almost every Hong Kong office does every single day: receiving a document on WhatsApp. With us is our Technician. Technician, what happened this time?

Technician: Hello May, hello everyone. In mid-October 2026, security researchers at Morphisec published an analysis of a malware campaign that spreads through WhatsApp, and several security outlets reported it. The lure is a ZIP file that pretends to be a financial document. Inside it is an executable called `Statement.exe`. If someone opens it, a long, hidden chain of events begins.

May: A ZIP file pretending to be a financial document — that sounds exactly like the kind of thing an accounts clerk would open without thinking twice.

Technician: That is precisely why it works.

Part 1: What is inside the ZIP

May: So what actually happens when someone opens it?

Technician: The ZIP carries a financial-document pretext — the kind of file people expect: a statement, an invoice, something money-related. Inside is `Statement.exe`, an executable disguised as a document. The moment it runs, it starts profiling the machine and trying to gain elevated privileges, including through COM auto-elevation techniques, with `ShellExecuteW` using the `runas` verb as a fallback.

May: Wait — does that mean it just bypasses Windows User Account Control?

Technician: Careful — no. Those techniques depend on the UAC settings and the circumstances the file runs under. They should not be read as a universal bypass of UAC. What matters is what happens next if it does get elevated privileges.

Part 2: How it reaches SYSTEM — the Task Scheduler step

May: What happens next?

Technician: Once it has elevated privileges, it enables `SeDebugPrivilege`, then injects code into the Windows Task Scheduler service host using a technique called PoolParty Variant 7, which abuses Windows thread-pool mechanisms instead of the more familiar `CreateRemoteThread` approach. Here is the key point: Task Scheduler runs as LocalSystem. So the injected code inherits SYSTEM authority.

May: SYSTEM — that is the highest level, right?

Technician: Yes. LocalSystem is among the most privileged built-in Windows security identities. Code running as SYSTEM can access sensitive system resources, manipulate services, modify protected files and perform other administrative operations. And because later stages inherit that token, they do not need to repeat the privilege-escalation step. The door is already open.

May: And using Task Scheduler — a normal Windows component — is what makes it hard to spot?

Technician: Exactly. The malicious code is running inside a legitimate Windows service. It does not look like a strange new program; it looks like Windows itself doing its job.

Part 3: What the attacker gets — VulcanRAT207.A

May: So the attacker is in at SYSTEM level. What can they actually do?

Technician: The final payload is called VulcanRAT207.A — a remote access trojan with a WebSocket connection back to its operators. According to the analysis, it can collect system data, run commands, manage files, capture screenshots, record keystrokes, create or change local accounts, and deploy more payloads. In other words: read your files, watch your screen, record what you type — including passwords — and bring in whatever else they want.

May: And if I restart the computer, does it go away?

Technician: No. The campaign creates a scheduled task that can restart the trojan with SYSTEM privileges after a reboot, and it uses a signed driver to try to terminate selected security processes. Restarting does not clean it. A signed driver is particularly sneaky because signed code looks legitimate to Windows.

Part 4: Why Hong Kong offices should care

May: This sounds like something aimed at big companies. Should a small Hong Kong business worry?

Technician: Absolutely. Think about how a Hong Kong SME actually works: suppliers send invoices on WhatsApp, clients send statements, accountants exchange tax files. Receiving a ZIP of financial documents through a messaging app is completely normal. That is what makes this campaign dangerous — it hides inside a routine workflow.

May: What if the file comes from someone I know?

Technician: A familiar sender is not proof of safety. Their account could be compromised, or the file could be forwarded from somewhere else. If a file is unexpected — especially a ZIP containing an executable — verify it through a separate channel before opening: call the person, or message them on a different app, and ask whether they really sent it. Do not reply inside the same chat thread to check, because if the account is compromised, you are asking the attacker.

May: And the golden rule — an executable is not a document?

Technician: Yes. A real statement is a PDF or a spreadsheet. A `.exe` file is a program. If the attachment ends in `.exe`, or Windows warns you it is an executable, stop. Also beware of disguised icons and double extensions — a file that looks like a PDF icon may not be a PDF. And never turn off your antivirus or UAC just to open a file someone sent you. Those prompts are there for exactly this moment.

Part 5: If you already opened it

May: OK, worst case: someone in the office already opened it. What now?

Technician: Four steps, in order. One: disconnect the machine from the network — unplug the cable or turn off Wi-Fi — to cut the remote connection. Two: do not log in to banking, email or anything sensitive on that machine; assume keystrokes may be recorded. Three: do not back up to a USB drive yet — you risk copying the malware along with your files. Four: get professional help quickly. A standard antivirus scan may not fully remove a SYSTEM-level infection with a persistence mechanism. Sometimes a clean system reinstall is the only safe option, and the backup has to be handled carefully so the malware is not carried back in.

May: And tell the rest of the office?

Technician: Yes — immediately. If one person received it, others may have too. Tell colleagues not to open the same file, and check whether the same ZIP is circulating in other chats.

Closing

May: So the summary: a WhatsApp ZIP pretending to be a financial document can end with an attacker running at SYSTEM level on your PC. Verify before you open, never run a `.exe` that arrived as a "document", and if you clicked — disconnect and get help fast.

Technician: Exactly. The whole attack starts with one click. Make that click a careful one.

May: That is all for this episode of *ComputerKing Computer ER*! If this saves one colleague from opening a bad file, share it in your office group — carefully, with the warning attached. See you next time!

How We Can Help

ComputerKing offers:

• 🦠 Malware cleanup: SYSTEM-level infection assessment, removal and clean reinstall
• 💾 Safe backup & restore: back up your data without carrying the malware back in
• 🔒 Office security check: antivirus, UAC and attachment-handling settings for staff machines
• 🏢 SME staff briefing: plain-language rules for WhatsApp and email attachments

Sources

• Morphisec analysis of the WhatsApp-delivered VulcanRAT207.A campaign, as reported by GBHackers: https://gbhackers.com/whatsapp-delivered-malware/
• CybersecurityNews coverage of the same campaign: https://cybersecuritynews.com/whatsapp-attachment-deploys-malware/
• Cyware Daily Threat Intelligence, 12 October 2026: https://www.cyware.com/resources/threat-briefings/daily-threat-briefing/cyware-daily-threat-intelligence-october-12-2026

This episode is a transcript of the show. Facts are cited from the sources above; the campaign's technical details are as reported by the researchers, and no Hong Kong victim is claimed in this article.