WhatsApp as an attack vector a misleading VBScript installs an RMM and takes control of the network

An active campaign is taking advantage of WhatsApp's direct messages to distribute malicious files in VBScript format that end up installing legitimate remote monitoring software (RMM), transforming a management tool into a back door for attackers. Safety investigators have documented that the operation mainly affects users of WhatsApp Desktop and WhatsApp Web in countries of Asia, Europe, Latin America and Oceania, with a significant concentration of victims in Malaysia.

The initial vector is simple and effective from the point of view of the attacker: files with names that mimic business documents such as "Financial Reports.vbs" or "Account Statement.vbs," sometimes located in other languages, are sent from accounts that appear to belong to known contacts. The key rupture is not an exotic payload, but the combination of social engineering, executable VBS files and implicit confidence in contact messages.

The scripts are strongly obfussed and contain comments designed to look like legitimate components of Windows Update, making manual detection difficult. When running via WScript.exe the VBScript download additional stages: one tries to manipulate the behavior of the User Account Control (UAC) and another recovers a ZIP containing the ManageEngine RMM Central installer. The result is not only classic malware, but the implementation of a legitimate management tool that provides persistent remote access.

The attack behaves differently according to the platform: in WhatsApp Web success depends on the victim downloading and opening the file from the download folder or browser history, while in WhatsApp Desktop it has been observed direct execution from the application process itself (with "WhatsApp.Rot.exe" spawnando "WScript.exe"), which raises problems of violation of the trust model between the client application and the operating system.

Beyond the immediate impact on the compromised equipment, the unauthorized installation of a legitimate MMR significantly increases the risk: these products allow remote control, additional software installation, and access to credentials and internal systems. In the hands of a malicious actor they can facilitate lateral movement, data theft and persistent hard to eliminate, because traditional defenses tend to rely on signed binaries and business management software.

For users and administrators, preventive measures are clear and should be implemented immediately: do not open files with script extensions (.vbs, .vbe, .js, .ps1, .bat, .cmd) received by instant messaging without verifying its origin; review and close WhatsApp Web / Desktop sessions unknown from the "Related Devices" section; activate the verification in two steps in WhatsApp; and keep the customer updated. In corporate environments it is appropriate to block the execution of WScript.exe by application control policies (AppLocker, WDAC), configure the browser to avoid direct execution of downloads, and apply rules in the EDR to alert when messaging processes launch scripts interpreters.

If you suspect you have downloaded or executed a suspicious file, disconnect the computer from the network and perform forensic analysis or consult the incident response team. Technical indicators published by researchers (including possible overlaps of infrastructure with previous campaigns) can help in detection, but the absence of definitive attribution implies that the response should focus on containment and mediation in the affected environment.

To deepen on the nature of the threats and general recommendations about malware and similar campaigns, see Kaspersky's research blog on https: / / www.kaspersky.com / blog /. If you want to review the specifications and risks associated with the RMM solution indicated in some reports, the ManageEngine supplier's page provides product information on https: / / www.manageengine.com / refote-monitoring-management /. In addition, WhatsApp maintains security tips on how to protect your account in https: / / www.Whatsapp.com / security.

The episode is a reminder that the attack chain does not always start with "exotic" malware: administrative tools and daily vectors, such as a VBS file sent by a contact, may be enough to compromise an organization. The best defense combines skepticism in users, technical policies that limit the execution of scripts and visibility in endpoints to detect abnormal behaviors.