WhatsApp VBScript Marketing campaign Makes use of Pretend Paperwork to Set up ManageEngine RMM Device

Ravie LakshmananJun 23, 2026Malware / Social Engineering

Direct messages despatched by way of WhatsApp are getting used to distribute malicious Visible Fundamental Script (VBScript) recordsdata that result in the set up of official Distant Monitoring and Administration (RMM) software program.

Per findings from Kaspersky, the lively marketing campaign is focusing on customers of WhatsApp Desktop and WhatsApp Internet throughout Malaysia, Brazil, India, Mexico, Singapore, the U.Okay., Spain, Taiwan, Australia, Russia, and Vietnam. The best focus of victims has been reported in Malaysia.

“The risk actor makes use of misleading file names masquerading as enterprise and monetary paperwork to influence recipients to obtain and execute the attachment,” safety researcher Fareed Radzi mentioned. “As soon as executed, the VBScript initiates a multi-stage an infection chain that finally ends in the set up of official Distant Monitoring and Administration (RMM) software program, enabling distant entry to the sufferer’s system.”

It is suspected that the risk actor behind the operation managed to acquire surreptitious entry to a number of WhatsApp accounts after which used them as a distribution vector for the VBScript recordsdata throughout their contacts. That mentioned, precisely how these accounts are compromised is unclear.

The closely obfuscated VBScript recordsdata are dressed up as seemingly innocent enterprise and monetary paperwork, utilizing names like “Monetary Studies.vbs” or “Account Assertion.vbs.” A number of the recordsdata are additionally named in different languages, equivalent to Portuguese, French, German, and Malay, reflective of the worldwide nature of the marketing campaign.

“As well as, the VBScript samples comprise in depth feedback and metadata supposed to imitate official Microsoft Home windows Replace elements,” Kaspersky defined. “Many of those feedback are written in Chinese language and embrace references to Home windows Replace modules, certificates validation, system integrity checks, and deployment-related performance.”

The VBScript file is launched utilizing “WScript.exe,” which then fetches and runs further VBScript elements required for the following levels of the assault. It is price noting that the an infection chain behaves slightly in another way primarily based on whether or not a sufferer is utilizing WhatsApp Internet or the WhatsApp Desktop software.

Within the case of the previous, the assault depends on the person downloading the file to their system after which opening it from the downloaded folder or by way of the browser’s obtain historical past, assuming it to be a official doc. In WhatsApp Desktop, the malware is executed straight inside the software, with the method tree revealing that “WhatsApp.Root.exe,” the background course of related to the consumer software, is liable for spawning “WScript.exe.”

The first goal of the VBScript is to obtain two secondary VBScript payloads from a distant server, considered one of which makes an attempt to tamper with Home windows Person Account Management (UAC) conduct, whereas the opposite downloads and executes a ZIP file containing the set up package deal for ManageEngine RMM Central.

The exercise stays unattributed, nonetheless, the Russian cybersecurity firm mentioned it discovered infrastructure overlaps (“202.61.160[.]201”) with prior exercise linked to Gh0st RAT and ValleyRAT.

“Customers ought to be cautious when receiving surprising attachments by way of WhatsApp, even once they seem to originate from identified contacts,” Kaspersky mentioned. “Script and executable file varieties equivalent to VBS, VBE, EXE, BAT, CMD, JS, and PS1 shouldn’t be opened until their legitimacy has been independently verified.”