Threat actors leverage compromised WhatsApp accounts to send malicious attachments directly to victims, making the messages appear legitimate.