WhatsApp Becomes a Malware Delivery Channel as Attackers Abuse VBScript and Legitimate Remote Access Software

Defenders have spent years treating email as the main route for malicious attachments. A newly observed campaign shows attackers moving somewhere defenders watch far less closely. Researchers have found criminals weaponizing direct file sharing through WhatsApp, using it to spread malicious scripts that ultimately install legitimate remote administration software and grant lasting access to victim systems.

Kaspersky identified the active campaign, which sends disguised Visual Basic Script (VBScript) files through WhatsApp conversations. Once a victim opens one, the file kicks off a multi-stage infection that silently deploys legitimate Remote Monitoring and Management (RMM) software, giving the attacker remote control of the machine. The operation was first observed in June 2026 and remains active.

The campaign reflects a wider trend. Attackers are leaning on legitimate software and trusted communication channels instead of dropping obviously malicious payloads.

Trust in Messaging Apps Is Now an Attack Surface

Traditional phishing arrives by email, where gateways and filters get a chance to catch it. Messaging apps like WhatsApp skip that layer and arrive with built-in trust.

The attackers appear to have taken over existing WhatsApp accounts, then used those accounts to send malicious attachments to people already in the victims’ contact lists. Because the message comes from a known contact, the usual caution around unsolicited files mostly disappears. Researchers noted that the messages often contained only the file, with no accompanying text.

Victims have been spotted across a wide geographic range, including Malaysia, Brazil, India, Mexico, Singapore, Spain, Australia, Russia, Taiwan, Vietnam, and the United Kingdom. Roughly 80 percent of observed victims were in Malaysia, suggesting a broad but opportunistic operation rather than a tightly targeted one.

Malicious Scripts Disguised as Financial Documents

The first payload shows up as a file that looks like routine business paperwork. Researchers observed filenames built to seem ordinary, including examples such as:

• Financial Reports.vbs
• Account Statement.vbs
• Payment Confirmation.vbs
• Debt Statement.vbs

To make the lure work in more places, the attackers translated filenames into several languages, including Portuguese, French, German, and Malay.

At a glance these files look harmless, but the .vbs extension is the giveaway. Unlike a real office document, a .vbs file tells Windows to run the embedded Visual Basic Script code the moment it is opened. The attackers also heavily obfuscated the scripts to slow down both reverse engineering and detection.

More interesting is the disguise inside the code. The scripts are stuffed with fake comments and metadata crafted to look like legitimate Windows components. Many of those comments are written in Chinese and reference Windows Update modules, certificate validation routines, system integrity checks, and deployment infrastructure. The fake artifacts appear designed to mislead both automated analysis tools and human analysts reviewing the code.

Behavior Differs Between WhatsApp Web and Desktop

One technical detail stands out. The infection behaves differently depending on how the victim uses WhatsApp.

On WhatsApp Web, victims have to manually download the attachment to their machine before opening it, usually from the browser’s download folder. On WhatsApp Desktop, execution is more direct. Process analysis showed the application’s background process, WhatsApp.Root.exe, spawning WScript.exe, the native Windows engine that runs VBScript files. That direct path produces an unusually clean delivery mechanism, sidestepping several security checks organizations associate with browser downloads.

A Multi-Stage Chain That Ends in Legitimate Remote Access

The first VBScript is only the opening move. From there the attack unfolds in stages:

• Initial execution. The victim opens the malicious VBScript delivered through WhatsApp.
• WScript launch. Windows Script Host (WScript.exe) starts and begins running the obfuscated code.
• Secondary payloads. The first-stage script reaches out to a remote server and downloads two more VBScript payloads.
• Privilege manipulation. One of those scripts repeatedly tries to modify the ConsentPromptBehaviorAdmin registry value to suppress Windows User Account Control (UAC) prompts, weakening the system’s security warnings.
• ZIP delivery. The other script downloads a ZIP archive containing a preconfigured installation package, complete with certificates and configuration files.
• RMM deployment. A launcher script (setup1.vbs) silently installs the legitimate ManageEngine Endpoint Central agent through msiexec.exe, Microsoft’s own installer service.
• Persistent access. With the agent installed, attackers gain long-term remote control using enterprise software that many detection systems already trust.

Because RMM tools are legitimate software used by IT teams everywhere, many endpoint protection products treat them as safe. This is a textbook example of Living-off-the-Land abuse, where attackers turn legitimate administrative tools into weapons rather than deploying traditional malware.

Infrastructure Hints at Links to Earlier RAT Activity

Researchers have not firmly tied the campaign to a known group, but infrastructure analysis revealed overlaps with earlier operations linked to Gh0st RAT and ValleyRAT. One shared element was the IP address 202.61.160[.]201, previously seen in activity connected to Chinese-speaking operators. Combined with the Chinese-language comments in the scripts, Kaspersky assesses a possible Chinese-speaking operator, but only with low confidence. The overlaps point to possible infrastructure reuse or shared resources rather than confirmed attribution.

Why Traditional Security Often Misses This

The campaign shows why modern malware delivery slips past conventional detection. Most security products focus on spotting malicious executables, suspicious network behavior, or known signatures once execution is underway. This campaign avoids almost all of those triggers.

The delivery happens through a trusted messaging app. The attachment looks like routine paperwork. Execution starts with a legitimate Windows scripting engine. The final payload is real remote administration software, not obvious malware. By the time an endpoint tool notices anything suspicious, the attacker may already have persistent access. The attack works not because the malware is advanced, but because the file is trusted just long enough to start running.

Why FileDNA CADR Stops the Attack Before It Starts

This campaign is a clear case for stopping threats at the file level, before anything executes, rather than waiting on endpoint detection after compromise has begun.

The CyberQuay FileDNA Platform tackles this through Content Analysis, Disarm and Reconstruction (CADR), treating the file itself as the primary attack vector. In this scenario, FileDNA would intervene at the earliest possible stage.

Before the attachment ever reaches the user, FileDNA performs deep structural inspection and analyzes the true file format instead of trusting the extension. It can detect suspicious embedded scripting behavior, identify heavily obfuscated code, spot malicious metadata anomalies, and flag executable script containers pretending to be business documents. Rather than letting dangerous active content run, CADR rebuilds the file into a safe version and strips the executable components out.

That upstream approach keeps the infection chain from ever reaching the later stages: VBScript execution through WScript, secondary payload downloads, UAC tampering, ZIP deployment, unauthorized RMM installation, and persistent remote access. The best moment to stop modern malware is not during command-and-control traffic or post-exploitation activity. It is the moment an untrusted file first enters the environment.

The Bigger Picture: Malware Is Returning to File-Based Delivery

After years of investment in endpoint detection and cloud security, attackers keep proving that the simplest path is often the most effective. Instead of chasing zero-day exploits, they increasingly weaponize messaging apps, shared collaboration tools, trusted document workflows, legitimate administrative software, and the operating system’s own scripting engines.

The common thread never changes. A file enters the environment, a user trusts it, and execution begins. Once that happens, every downstream security layer is forced to react instead of prevent.

References

1. Kaspersky Securelist An unknown actor distributes malicious VBS scripts via WhatsApp
2. The Hacker News WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
3. ManageEngine Endpoint Central Documentation
4. Microsoft Windows Script Host Documentation
5. MITRE ATT&CK Command and Scripting Interpreter (T1059)
6. MITRE ATT&CK Remote Access Software (T1219)