WhatsApp VBScript Campaign Distributes Fake Documents to Install ManageEngine RMM

Intelligence Summary

A WhatsApp-based campaign is using direct messages to deliver malicious VBScript files. The messages contain fake document lures intended to trick recipients into running the scripts. Once executed, the VBScript can install a legitimate ManageEngine remote monitoring and management (RMM) tool. The targeting includes users of WhatsApp Desktop and WhatsApp Web across multiple countries. This matters because social engineering can lead to full tool installation, expanding remote access and persistence risk. Users should avoid opening unexpected documents or running scripts received via WhatsApp and verify message authenticity.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics