PhishingPublished 22 Jun 2026

WhatsApp phishing attack uses fake business docs to hack PCs

Source Bleeping Computer

Description

An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. [...]

Impact

Successful execution of the malicious VBScript leads to attackers gaining persistent remote administration access to the victim's Windows PC via a legitimate IT management tool configured for malicious use. This compromises system confidentiality, integrity, and availability. The campaign leverages trusted contacts to increase infection likelihood and bypasses some user protections by disabling UAC. The global reach and use of localized filenames increase the potential victim pool.

Defensive guidance

Users should treat all files received via WhatsApp, even from trusted contacts, with caution and verify their legitimacy through secondary communication channels. All downloaded files should be scanned with up-to-date antivirus software before execution. Organizations should educate users about the risks of opening unexpected attachments and monitor for signs of ManageEngine Endpoint Central installations configured outside normal IT management policies.

Summary

This ongoing malware campaign leverages compromised WhatsApp accounts to distribute heavily obfuscated VBScript files named as business or financial documents. Upon execution on Windows systems, the VBScript downloads additional scripts that disable UAC protections via registry changes and fetch a ZIP archive containing ManageEngine Endpoint Central, which is installed silently and configured to connect to attacker-controlled management servers. This grants remote administration access to the attackers. The campaign is global, with telemetry showing infections in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia. The initial WhatsApp account compromise method remains unknown. The campaign shows some infrastructure overlap with known RAT malware but lacks definitive attribution.

References

bleepingcomputer.com/news/security/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2026, 23:09 UTC

References

Community reviews

Related threats