Active WhatsApp Campaign Delivers VBScript Loader to Silently Install ManageEngine Endpoint Central RMM
July 8th, 2026
High
Our Cyber Threat Intelligence Unit is tracking an active malware campaign that distributes malicious VBScript (.vbs) files via compromised WhatsApp accounts. First observed in June 2026, the campaign remains active as of this advisory. Threat actors use deceptive, finance-themed file names to prompt WhatsApp Desktop and WhatsApp Web users on Windows to download and open malicious attachments. Once executed, the file initiates a multi-stage infection chain that silently installs a preconfigured ManageEngine Endpoint Central agent, granting the attacker persistent remote access to the victim's device. The campaign is broad and opportunistic, with confirmed victims in Malaysia, Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, Australia, Russia, and Vietnam. Approximately 80% of confirmed victims are in Malaysia. While the campaign primarily targets individual consumers, it poses a direct enterprise risk when affected devices connect to corporate networks or cloud environments.
Technical Details
Threat Type: Multi-stage VBScript malware campaign abusing legitimate RMM software
Severity: High
Affected Systems: WhatsApp Desktop and WhatsApp Web users on Windows
CVE ID: Not applicable (no vulnerability exploited; relies on social engineering and script execution)
Threat Actors: Unattributed; Kaspersky researchers assess with low confidence that the campaign may be linked to a Chinese-speaking threat actor, citing Chinese-language code artifacts and infrastructure overlap with prior ValleyRAT and Gh0st RAT activity
Attack Chain:
Initial Access: Threat actors compromise WhatsApp accounts via an unknown method and use them to distribute malicious VBScript attachments to the compromised account's contacts. Messages contain the attachment only, with no accompanying text.
Social engineering: File names mimic invoices, account statements, debt notices, and bank statements (e.g., "Financial Reports.vbs," "Outstanding Payment List.vbs"). Several names are localized into Portuguese, French, German, and Malay, suggesting region-specific targeting.
Execution: Two user actions are required to initiate the infection: downloading the attachment, then opening it. On WhatsApp Desktop, Windows Script Host (WScript.exe) is spawned directly by WhatsApp.Root.exe. On WhatsApp Web, the user must open the file from the Downloads folder or browser history, with explorer.exe or the active browser serving as the parent process.
Stage 1:
The initial VBScript creates a randomly named working directory under C:\Users\Public\Documents\ commonly using names such as Temp_<random> or MSUpdate_<random> and downloads two secondary VBScript payloads from attacker-controlled infrastructure. Some variants assign hidden and system attributes to the working directory and downloaded files.
Obfuscation techniques include string concatenation, encoded VBScript, randomized variable names, and junk content. Several variants copy curl.exe and bitsadmin.exe into the working directory under DLL-like filenames to disguise download activity and may stage payloads with misleading extensions (.pdf, .txt) before renaming them to .vbs for execution.
Stage 2 (two parallel scripts):
One script repeatedly attempts to modify the registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin, using an elevated ShellExecute "runas" call, in an attempt to suppress future User Account Control prompts.
A second script creates another randomized working directory, downloads a ZIP archive using curl, bitsadmin, certutil, PowerShell, or direct HTTP requests, extracts it, and runs an embedded setup1.vbs.
Stage 3 (payload installation): The ZIP archive contains a preconfigured ManageEngine Endpoint Central deployment package, including the agent installer (UEMSAgent.msi), custom MSI configuration (UEMSAgent.mst), server configuration file (DCAgentServerInfo.json), and associated certificates. The setup1.vbs script verifies that required installation files are present, requests administrative privileges via runas, then silently installs the Endpoint Central agent using msiexec.exe. On successful installation, the agent connects to attacker-controlled management servers identified in the embedded DCAgentServerInfo.json configuration.
Impact
Persistent Unauthorized Remote Access: Silent installation of the Endpoint Central agent places the victim's device under full attacker-controlled remote management, including file access, command execution, and software deployment capabilities.
Data Exposure and Theft: Attacker-controlled remote access creates direct risk of exfiltration of sensitive financial records, business documents, and credentials consistent with the social engineering lures used to deliver the payload.
Enterprise Lateral Movement: Where an affected device has connectivity to a corporate network or cloud environment, the unauthorized RMM foothold can serve as a pivot point for lateral movement, further credential compromise, or additional payload deployment.
Business Continuity Disruption: Compromised devices may require isolation and reimaging, diverting IT and security resources and interrupting normal operations.
Compliance and Regulatory Exposure: Unauthorized access to regulated data on affected devices may trigger reporting obligations under applicable privacy and data protection frameworks.
Detection Method
Monitor for WScript.exe spawned by WhatsApp processes (WhatsApp.Root.exe) or by explorer.exe and browser processes following download of a .vbs or .vbe file attachment.
Alert on the creation of directories under C:\Users\Public\Documents\ with randomized naming patterns such as Temp_<random>, MSUpdate_<random>, Sys<random>, or Data<random>.
Watch for repeated registry write attempts targeting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin, particularly those triggered through ShellExecute with the runas verb.
Detect system binaries (curl.exe, bitsadmin.exe) copied to non-standard working directories and renamed with DLL-like filenames, particularly where these are followed by outbound file download activity.
Flag unsanctioned silent installations of ManageEngine Endpoint Central agent (UEMSAgent.msi) executed via msiexec.exe outside of an IT-approved deployment process.
Monitor outbound network connections to the IP addresses and domains listed in Section 5.0, with priority on the UEMS management server IPs, which represent active attacker-controlled C2 infrastructure.
Indicators of Compromise
Type | Indicator | Description |
IP | 202.61.160[.]202 | Attacker-controlled ManageEngine Endpoint Central (UEMS) management server |
IP | 202.61.160[.]201 | Attacker-controlled ManageEngine Endpoint Central (UEMS) management server |
IP | 202.61.160[.]137 | Attacker-controlled ManageEngine Endpoint Central (UEMS) management server |
IP | 202.61.160[.]160 | Attacker-controlled ManageEngine Endpoint Central (UEMS) management server |
IP | 202.61.160[.]208 | Attacker-controlled ManageEngine Endpoint Central (UEMS) management server |
IP | 38.55.151[.]63 | Attacker-controlled ManageEngine Endpoint Central (UEMS) management server |
Domain | temu.baskwms[.]top | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | invoice.msopsa[.]top | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | qse.shoppes[.]help | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | shaaslong[.]one | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | baoxis[.]cc | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | baolongwes.oss-ap-southeast-1.aliyuncs[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | sdcwww.oss-ap-southeast-1.aliyuncs[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | baoyuw2s.s3.ap-southeast-1.amazonaws[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | hksha3.s3.ap-southeast-1.amazonaws[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | sjdkjj23.s3.ap-southeast-1.amazonaws[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | xijkwm2.s3.ap-southeast-1.amazonaws[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | yifubafu.s3.ap-southeast-1.amazonaws[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | caiwuascw.s3.us-east-005.backblazeb2[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
Domain | facaia.s3.us-east-005.backblazeb2[.]com | Attacker-controlled infrastructure hosting VBScript or ZIP payloads in the infection chain |
MD5 | c7f38cbb99c8b74fa0465293feeba700 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | b7cd06c71465038b658a6dc1f273a507 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 9f13c7b8ba391b2f597874e54d310648 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 7f81c1bc8cfd588e8998968e2621456e | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 7403cbcc5a9c32384d431856dc48fcc9 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 68c16c46f8afb9e00bbaba0207fb0a46 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 66442f2457eca8f47385b1fb2c6fcab8 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 6359e6236471cbe434d0ef4c42b7f879 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 5b6bbcc06cf08cc99e1afeda486d42fb | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 5002eca748205d544618e3bd2dedc223 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 4f0593e8e0e8fac49429e9b45ebf7fa1 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 4044e4b6471c9de7b0a4ba37d9d9df9a | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 20209b3a32769afc6a75694b8d8839dd | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 0ba93109757776a44de9d8c88baa4963 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 02bb20455cc592a69c080abac770ce90 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 6c39900d77dcba158e1d27c7619cb06d | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | dad708e050632a4280cabf98ac1376b7 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 05d188f071d097f5b6bd8138749b4b14 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 2c6f05f1f309d89b2236e6c8b59c88f9 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 3b1aba44dd3d9b6339b6f56e2f42034b | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | d43fdaa1f0ee09d7e5f0f94ee9df7b6c | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | df4fa0369eaca5cec348be293890d4af | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 63ac85195b73753333316a889cf5880f | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 74fd9f91fc93b6288b4fc253ea5b3e20 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | d06333c360b51456f427e616c3c5f8bd | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 993f4c0cadbc769a4b0ed62a918db58d | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 1d94fbe9cab21278cc3f104bea334d08 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 9d9ac85765e4a818a3ccabe2cf4fef82 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 6fb6a55424adfb61e31f06aef33273e5 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | f90ed4b2d0b67114aa89ddfed658e5c0 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 8c3322009b8982663c0cbecd9492e7eb | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 66705384a7ad81d14c34fc6c054a0ecf | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 8c6d9fc389ad3f20ccbc71d77eb39bfa | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 1a3cc75466ffb1971482f7abf7aabc3f | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 1c47c63e5ed25060d95359c57c77b107 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 31037a42ca048e06e69a78f55bc2eff5 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 7f16449cd0c4862d1eadf8a5742bf09a | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 79ecd61b09b0f2d54b34586c916c4ec9 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | 7849061c536a3efb05a56d504694e7e7 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | ddaffe9849f7f3c79f8804adb9a6b3d5 | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
MD5 | d01cad98dd0d01b75e04e784953c5e2b | WhatsApp VBScript malware sample (MD5; SHA-256 not published by source) |
Recommendations
Apply application controls to block execution of script file types (.vbs, .vbe, .js, .ps1, .bat, .cmd) received through messaging applications, regardless of the apparent sender identity.
Restrict standard users from installing or modifying RMM and remote management software without explicit IT approval; enforce software allowlisting where feasible.
Establish a verification procedure for unexpected attachments: confirm legitimacy with the apparent sender through a separate communication channel before opening any file received via WhatsApp.
Monitor endpoint and SIEM telemetry for the process, registry, directory creation, and network indicators described in Sections 4.0 and 5.0, and create detection rules aligned to the attack chain stages described in Section 2.0.
Enforce endpoint visibility controls to ensure RMM agent installations are logged, alerted on, and reviewed centrally by IT and security operations.
Conduct user awareness training to communicate that WhatsApp account compromise can result in malware distribution to trusted contacts with no accompanying message text, and that financial document themes are a common social engineering vector.
Maintain tested offline backups and verify restore procedures to limit the operational impact of any follow-on compromise originating from an unauthorized RMM foothold.
Conclusion
This campaign exploits WhatsApp's trusted-contact delivery model to bypass user skepticism and distribute a multi-stage VBScript chain that silently installs a legitimate RMM agent under the attacker's control. Because no software vulnerabilities are exploited, patching alone offers no protection; the risk depends entirely on user behavior and endpoint controls. Organizations should prioritize blocking script execution from messaging applications, enforcing governance over RMM installations, and deploying detection coverage for the process and registry behaviors identified in this advisory. The campaign remains active, and its geographic reach continues to expand.
References
https://securelist.com/whatsapp-vbs-rmm-campaign/120290/
https://thehackernews.com/2026/06/whatsapp-vbscript-campaign-uses-fake.html
https://socradar.io/blog/whatsapp-vbscript-campaign-manageengine-endpoint/
https://www.redsecuretech.co.uk/blog/post/whatsapp-vbscript-malware-installs-rmm-backdoors/1267