WhatsApp VBScript Campaign Uses Fake Documents to Install Manage Engine RMM Tool
Summary: Kaspersky reports an active WhatsApp campaign distributing obfuscated VBScript files disguised as business and financial documents, such as "Financial Reports.vbs" and "Account Statement.vbs," that install the legitimate ManageEngine RMM Central tool and grant remote access. The campaign targets WhatsApp Desktop and WhatsApp Web users across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam, with the highest concentration of victims in Malaysia, and Kaspersky found infrastructure overlaps with prior Gh0st RAT and ValleyRAT activity.
Why it matters: The payload is a legitimate RMM tool, so the final install may look like sanctioned software rather than malware, and the delivery channel is a messaging app your users already trust enough to open attachments from known contacts.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026