WhatsApp VBScript Campaign Installs ManageEngine RMM, Kaspersky Warns
Published
Key Takeaways
- Campaign Discovered: A June 2026 malware campaign is spreading malicious VBScript files via WhatsApp direct messages.
- RMM Abuse: The infection chain ultimately installs a preconfigured ManageEngine Endpoint Central (UEMS) RMM agent for remote access.
- Wide Reach: Victims span Brazil, India, Mexico, the U.K., Spain, Taiwan, Australia, Russia, and more.
An active malware campaign distributes malicious VBScript (VBS) files through WhatsApp direct messages. First observed in June 2026, the operation targets WhatsApp Desktop and WhatsApp Web users, with roughly 80% of victims located in Malaysia, Kaspersky researcher Fareed Radzi has discovered.
How the WhatsApp VBScript Attack Works
The threat actor gained access to several WhatsApp accounts and used them to push the malicious attachments to contacts on the compromised users' lists. Messages contained only the file, with no accompanying text.
Lures relied on financial-themed filenames such as Financial Reports.vbs, Account Statement.vbs, and Debt Statement.vbs, with several localized into Portuguese, French, German, and Malay.
According to Kaspersky, once executed via Windows Script Host, the Stage 1 VBScript creates a working directory and downloads two secondary payloads:
- One script repeatedly attempts to modify the ConsentPromptBehaviorAdmin registry value to suppress Windows User Account Control (UAC) prompts.
- The second downloads a ZIP archive and runs an embedded setup1.vbs.
ManageEngine Endpoint Central Deployment and Attribution
The ZIP archive contains a preconfigured deployment package of the legitimate ManageEngine Endpoint Central Remote Monitoring and Management (RMM) software, including certificates and configuration files. The setup1.vbs launcher silently installs the agent through msiexec.exe, granting persistent remote access.
Victims were identified across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.
Chinese-language comments and an infrastructure overlap, IP address 202.61.160.201, previously tied to ValleyRAT and Gh0st RAT activity, led Kaspersky to assess with low confidence that a Chinese-speaking operator may be responsible.
In March, Russian hackers targeted Signal and WhatsApp accounts of high-value individuals in a large-scale phishing operation.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular