WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool

A new active campaign is targeting WhatsApp Desktop and WhatsApp Web users across multiple countries, including Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam. According to Kaspersky, the threat actor sends direct messages containing malicious Visual Basic Script (VBScript) files disguised as legitimate business and financial documents, such as ‘Financial Reports.vbs’ or ‘Account Statement.vbs.’

Once the victim executes the VBScript file via WScript.exe, a multi-stage infection chain begins. The script downloads additional VBScript components from a remote server, one of which attempts to tamper with Windows User Account Control (UAC) behavior, while the other downloads and executes a ZIP file containing the installation package for ManageEngine RMM Central, a legitimate Remote Monitoring and Management (RMM) tool. This grants the attacker remote access to the victim’s system.

The attack vector differs slightly between WhatsApp Web and WhatsApp Desktop. On WhatsApp Web, the user must manually download and open the file. On WhatsApp Desktop, the malware executes directly within the application, with the background process WhatsApp.Root.exe spawning WScript.exe. The VBScript samples contain extensive comments and metadata in Chinese, mimicking legitimate Microsoft Windows Update components to evade detection.

The campaign remains unattributed, but Kaspersky found infrastructure overlaps (IP address 202.61.160[.]201) with prior activity linked to Gh0st RAT and ValleyRAT. Kaspersky advises users to be cautious with unexpected attachments, especially script and executable file types like VBS, VBE, EXE, BAT, CMD, JS, and PS1, and to verify their legitimacy before opening.