WhatsApp phishing attack uses fake business docs to hack PCs

1. Executive summary

An active malware campaign is distributing malicious VBScript (.vbs) attachments via direct messages on WhatsApp Desktop and WhatsApp Web, using compromised contact accounts to seed the spread. The attachments masquerade as invoices, account statements, debt notices, payment records and bank statements, with file names localised into Portuguese, French, German and Malay. Execution triggers a multi-stage chain that disables UAC via Registry modification, drops a ZIP archive, and silently installs ManageEngine Endpoint Central — a legitimate Remote Monitoring and Management (RMM) product — configured to connect to attacker-controlled management servers, granting the operator full remote administration over the victim host. Confirmed victim geography spans Malaysia, Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia and Vietnam, with Malaysia the most affected. For EMEA financial services, the bottom-line risk is unauthorised remote access to endpoints handling payment, treasury or customer data, achieved through a supply-chain-adjacent RMM tool that bypasses native UAC controls and is unlikely to be flagged by signature-based AV alone.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17 (ICT-related incident management process)	A successful infection of a financial-entity endpoint by this campaign constitutes an ICT-related incident requiring a defined response process.	Activate the entity's ICT incident management process; preserve WScript.exe process tree, command line, and Registry artefacts for root cause.
DORA Art. 18 (classification of ICT-related incidents and cyber threats)	The campaign installs an attacker-controlled RMM agent — a high-impact cyber threat that bypasses UAC and provides persistent remote access.	Classify the event against the entity's ICT-related incident taxonomy; treat any confirmed infection as a major-class candidate pending impact assessment.
DORA Art. 19 (reporting of major ICT-related incidents to competent authorities)	A confirmed compromise with remote access to a system handling regulated workloads meets the criteria for a major ICT-related incident.	Report per the competent authority's timeline and template once classification is confirmed.
DORA Art. 28 (ICT third-party risk — general principles)	ManageEngine Endpoint Central is an ICT third-party provider; the campaign weaponises its legitimate RMM binary.	Reassess third-party risk treatment for any RMM/EDR agent permitted on regulated endpoints; restrict to vetted, vendor-signed binaries.
DORA Art. 29 (preliminary assessment of ICT concentration risk)	Concentration risk arises where multiple entities rely on the same RMM product (ManageEngine Endpoint Central) that is now being abused as a foothold.	Map concentration exposure to ManageEngine Endpoint Central across the entity's estate and suppliers.
DORA Art. 30 (key contractual provisions with ICT third-party providers)	Use of ManageEngine Endpoint Central implies a contractual relationship that must support incident response, audit and termination rights.	Verify contractual clauses permit rapid evidence preservation, log access and termination if the agent is abused.
NIS2 Art. 21(2)(d) (supply chain security measures)	The attack chain abuses a legitimate third-party RMM tool — a textbook supply-chain compromise vector.	Apply supply-chain security controls to any RMM/remote-admin tool: allowlisting, vendor pinning, integrity verification.
NIS2 Art. 23 (incident reporting obligations)	A confirmed infection with remote access is an incident with potential significant impact.	Stage early-warning and incident notifications per the entity's NIS2 reporting workflow.
UK NIS 2018 (OES/RDSP duties)	UK-based victims (UK listed in affected geography) handling essential services may be OES/RDSP and inherit incident-handling duties.	UK OES/RDSP entities must apply their incident-handling regime and notify the appropriate UK competent authority.

3. Technical analysis & attack chain

Initial access — WhatsApp DM with malicious attachment. A compromised contact sends a .vbs file via WhatsApp direct message. The message body contains no text — only the attachment. Distribution occurs from multiple already-compromised WhatsApp accounts to their contact lists.
User interaction (two clicks). On WhatsApp Desktop the file is executed directly by clicking the file icon or selecting "Open" in the chat. On WhatsApp Web the file must first be downloaded and then opened. Two user interactions are required in both flows.
Execution via Windows Script Host. The .vbs is launched by WScript.exe. On WhatsApp Desktop the parent process is WhatsApp.Root.exe; the script is loaded from the WhatsApp Desktop attachment storage directory.
Stage-2 retrieval. The initial VBScript fetches two additional scripts from attacker-controlled infrastructure.
UAC bypass via Registry modification. The stage-2 scripts modify Registry values to disable UAC protections.
Stage-3 payload drop. A ZIP archive containing ManageEngine Endpoint Central is downloaded and silently installed in the background.
RMM configuration and C2. The installed ManageEngine agent is configured to connect to attacker-controlled management servers, granting the operator remote administration over the victim host.

Technical specifics

Affected clients: WhatsApp Desktop (Windows) and WhatsApp Web (browser).
File type: .vbs (VBScript); heavily obfuscated.
Loader process: C:\Windows\System32\WScript.exe.
Parent process (WhatsApp Desktop): WhatsApp.Root.exe.
Observed execution path (WhatsApp Desktop): "C:\Windows\System32\WScript.exe" "C:\Users\<username>\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\<session_identifier>\Transfers\<YYYY-MM>\financial reports(s).vbs"
Final payload: ManageEngine Endpoint Central (legitimate RMM) installed silently and pointed at attacker-controlled management servers.
Social-engineering lures: file names referencing invoices, account statements, debt notices, payment records, bank statements; localised into Portuguese, French, German and Malay.
Script cosmetics: extensive comments and metadata mimicking Microsoft Windows Update components, including certificate validation, system integrity checks and deployment-related functionality; many comments written in Chinese.
Affected geography (confirmed): Malaysia (highest victim count), Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia, Vietnam.

Caveats and unconfirmed claims

The exact method used to compromise the seeding WhatsApp accounts is not known at the time of reporting.
Kaspersky has not attributed the campaign to a named threat actor. Infrastructure overlap with IPs previously associated with ValleyRAT and Gh0st RAT activity, combined with Chinese-language artefacts in the scripts, is noted, but high-confidence attribution is not possible on the evidence available. Treat any actor attribution as unconfirmed.
No CVE is associated with this campaign; the initial-access vector is social engineering, not a software vulnerability. No CVSS score or CISA KEV state applies.

4. Mitigation & containment

P1 — within 24 hours (containment)

Block .vbs execution from user-writable locations. Enforce via AppLocker/Windows Defender Application Control policy denying wscript.exe and cscript.exe execution of .vbs from %LOCALAPPDATA%, %APPDATA%, Downloads, and the WhatsApp Desktop LocalState path above.
Hunt for the WhatsApp-Desktop execution signature. Search EDR telemetry for WScript.exe or cscript.exe with parent WhatsApp.Root.exe and command line containing AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\.
Inventory ManageEngine Endpoint Central installations. Enumerate endpoints running ManageEngine Endpoint Central (agent/service binaries under ManageEngine install paths and the agent's scheduled tasks/services). Any installation not traceable to a documented IT change is suspect.
Isolate any endpoint meeting either of the above criteria via EDR network containment; preserve memory and disk image before reimaging.
Block outbound traffic from any suspect host to non-corporate RMM infrastructure; force RMM agents to talk only to the entity's own ManageEngine server.

P2 — within 72 hours (remediation)

Disable UAC-bypass artefacts. Audit and revert Registry modifications consistent with UAC bypass (e.g. EnableLUA, ConsentPromptBehaviorAdmin, PromptOnSecureDesktop under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and HKCU\...\Policies\System); restore defaults.
Remove the RMM foothold. Uninstall ManageEngine Endpoint Central from any endpoint where it was not deployed by IT; revoke any agent certificates/keys issued to attacker-controlled servers.
Rotate credentials for any account that used the compromised endpoint, including WhatsApp Web session cookies and any cached domain credentials.
Force WhatsApp logout of all sessions for affected users (Settings → Linked Devices → Log out all) and require re-authentication with MFA.
User awareness comms. Issue a targeted notice to staff in affected geographies (UK, Spain, Russia, plus any entity with operations in Brazil, India, Mexico, Singapore, Taiwan, Australia, Vietnam, Malaysia) warning of unsolicited .vbs attachments arriving via WhatsApp, even from known contacts.

P3 — within 7 days (hardening)

Restrict RMM tooling. Move ManageEngine Endpoint Central (and any equivalent RMM) behind a vetted allowlist; require signed-binary integrity verification before agent install.
Tighten UAC. Enforce the highest UAC policy group-wide; monitor for any subsequent attempts to weaken it.
Email/chat DLP. Extend DLP to flag .vbs, .js, .wsf, .hta attachments regardless of source channel.
Tabletop exercise. Include this campaign in DORA Art. 24 testing scope: simulate a WhatsApp-delivered RMM foothold and validate detection-to-containment timing.

5. Indicators of compromise

Type	Value	Confidence	Source
Process relationship	`WScript.exe` (or `cscript.exe`) spawned by `WhatsApp.Root.exe`	High	Securelist (Kaspersky GReAT)
Command-line path	`C:\Users\<username>\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\<session_identifier>\Transfers\<YYYY-MM>\` containing a `.vbs` file	High	Securelist (Kaspersky GReAT)
File-name lure pattern	`.vbs` filenames referencing invoices, account statements, debt notices, payment records, bank statements (localised into Portuguese, French, German, Malay)	High	Securelist (Kaspersky GReAT); BleepingComputer
Payload	ManageEngine Endpoint Central installed silently and pointed at attacker-controlled management servers	High	BleepingComputer; Securelist
Script cosmetics	VBScript containing Chinese-language comments referencing Windows Update modules, certificate validation, system integrity checks, deployment-related functionality	Medium	Securelist (Kaspersky GReAT)
Technique	UAC bypass via Registry modification prior to payload install	High	BleepingComputer

process_parent_child  WScript.exe <- WhatsApp.Root.exe
process_parent_child  cscript.exe <- WhatsApp.Root.exe
filepath  C:\Users\<username>\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\<session_identifier>\Transfers\<YYYY-MM>\*.vbs
payload  ManageEngine Endpoint Central (attacker-configured RMM)
script_string  Windows Update (Chinese-language comments)
script_string  certificate validation
script_string  system integrity checks

6. Detection

YARA rule

rule AT_WhatsAppVBS_RMM_Footprint_2026_06
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-23"
        description = "Detects VBScript artefacts consistent with the WhatsApp-delivered ManageEngine Endpoint Central RMM campaign"
        reference = "https://securelist.com/whatsapp-vbs-rmm-campaign/120290/"

    strings:
        $path1 = "5319275A.WhatsAppDesktop_cv1g1gvanyjgm\\LocalState\\Sessions\\" ascii nocase
        $path2 = "WhatsApp.Root.exe" ascii nocase
        $path3 = "AppData\\Local\\Packages\\5319275A.WhatsAppDesktop_cv1g1gvanyjgm" ascii nocase
        $lure1 = "financial reports" ascii nocase
        $lure2 = "invoice" ascii nocase
        $lure3 = "account statement" ascii nocase
        $lure4 = "payment record" ascii nocase
        $lure5 = "bank statement" ascii nocase
        $cos1  = "Windows Update" ascii nocase
        $cos2  = "certificate validation" ascii nocase
        $cos3  = "system integrity" ascii nocase
        $cos4  = "deployment" ascii nocase

    condition:
        uint16(0) == 0x6548 and filesize < 5MB and (
            any of ($path*) or
            (1 of ($lure*) and 1 of ($cos*))
        )
}

Sigma rule

title: WScript Spawned by WhatsApp Desktop Loading VBScript
id: 9c4a1f6e-2b8d-4a17-9b6e-7d2f1a3c5e8b
status: experimental
description: >
    Detects wscript.exe or cscript.exe spawned by WhatsApp.Root.exe and loading
    a .vbs file from the WhatsApp Desktop LocalState Sessions Transfers path,
    consistent with the WhatsApp-delivered ManageEngine Endpoint Central RMM campaign.
author: Adverse Trace
date: 2026-06-23
reference: https://securelist.com/whatsapp-vbs-rmm-campaign/120290/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\WhatsApp.Root.exe'
    selection_child:
        Image|endswith:

            - '\wscript.exe'
            - '\cscript.exe'
    selection_cmdline:
        CommandLine|contains:

            - '5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\'
            - '\Transfers\'
    filter_benign:
        CommandLine|endswith:

            - '.vbs'
    condition: selection_parent and selection_child and selection_cmdline and filter_benign
fields:

    - User
    - Computer
    - ParentCommandLine
    - CommandLine
falsepositives:

    - Unknown (no legitimate wscript.exe under WhatsApp.Root.exe observed)
level: high

7. Sources

BleepingComputer — WhatsApp phishing attack uses fake business docs to hack PCs — https://www.bleepingcomputer.com/news/security/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs/ — 2026-06-22
Securelist (Kaspersky GReAT) — A VBScript campaign distributed through WhatsApp deploying RMM software — https://securelist.com/whatsapp-vbs-rmm-campaign/120290/ — 2026-06
The Hacker News — WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool — https://thehackernews.com/2026/06/whatsapp-vbscript-campaign-uses-fake.html — 2026-06

8. Adverse Trace position

Severity: High. The campaign weaponises a legitimate, signed RMM product (ManageEngine Endpoint Central) installed silently after a UAC bypass, granting the operator persistent remote administration that will evade signature-based controls and blend in with sanctioned IT tooling. For EMEA financial services the principal concern is not the WhatsApp vector itself but the resulting foothold on endpoints that touch payment, treasury and customer data — a scenario that engages DORA incident-management, classification, reporting and third-party-risk obligations, NIS2 supply-chain and incident-reporting duties, and UK NIS OES/RDSP incident handling where UK-based staff are affected. Client impact: any entity with users in the eleven confirmed geographies (notably the UK and Spain) should treat this as a P1 hunt-and-block exercise, audit ManageEngine Endpoint Central deployments for unauthorised installs, and review DORA/NIS2 reporting triggers for any confirmed compromise. Next steps: Adverse Trace will (a) monitor for additional IOCs and infrastructure overlap with ValleyRAT/Gh0st RAT, (b) track any named-actor attribution as evidence permits, and (c) update this advisory if a vendor fix, WhatsApp-side mitigation, or new compromise vector for the seeding accounts is disclosed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.