Loading story…
Researchers reported an active campaign in which compromised WhatsApp accounts sent malicious .vbs attachments to targets in multiple countries, with most observed infections in Malaysia. The lures impersonated business, banking, tax, and debt-related documents and primarily targeted users of WhatsApp Desktop and WhatsApp Web. When opened, the VBScript launched through Windows Script Host, created hidden working directories, and fetched additional payloads from attacker-controlled infrastructure while using obfuscation and renamed native tools such as curl.exe and bitsadmin.exe to reduce detection.
A second-stage script attempted to weaken Windows User Account Control by changing ConsentPromptBehaviorAdmin, then downloaded a ZIP archive containing a preconfigured ManageEngine Endpoint Central deployment package. The final stage silently installed the legitimate ManageEngine Endpoint Central agent via msiexec.exe, giving the attacker remote administration access to the compromised system. Attribution remains unconfirmed, but researchers noted simplified Chinese comments in the scripts and infrastructure overlap with IP addresses previously associated with ValleyRAT and Gh0st RAT activity, indicating with low confidence that a Chinese-speaking operator may be behind the campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Erik Hjelmvik analyzed the June 2026 WhatsApp-delivered VBScript campaign and identified a related sample that downloaded a dropper from Backblaze B2 and installed the Ping32 remote monitoring and management tool instead of ManageEngine Endpoint Central. By pivoting on the Ping32 C2 server, he also found infrastructure overlap with DonutLoader and ValleyRAT using UDP port 10086 and the Gh0stKCP protocol, strengthening but not confirming the ValleyRAT connection.
Kaspersky disclosed additional details on the WhatsApp malware campaign, saying hijacked accounts sent fake debt-related VBScript attachments that used multi-stage obfuscated scripts, attempted to weaken Windows UAC via registry changes, and silently installed a pre-configured ManageEngine Endpoint Central agent. The researchers also reported infrastructure overlap with activity linked to ValleyRAT and Gh0st RAT, but said attribution remained unconfirmed and only low-confidence indicators suggested a Chinese-speaking operator.
Researchers observed an active malware campaign in June 2026 in which compromised WhatsApp accounts sent malicious VBScript attachments to victims in multiple countries, with Malaysia accounting for most observed infections. The infection chain ultimately installed the legitimate ManageEngine Endpoint Central agent to provide the attacker with remote administration access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
netresec.com
Open sourcethehackernews.com
Open sourcecommunity.gurucul.com
Open sourcecysecurity.news
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcebleepingcomputer.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported a multi-stage malware campaign that used **WhatsApp messages** to trick targets into opening malicious **Visual Basic Script** (`.vbs`) files. The activity, observed from late February 2026, relied on social engineering and trusted cloud infrastructure including **AWS S3**, **Tencent Cloud**, and **Backblaze B2** to host follow-on payloads. After execution, the malware created hidden folders under `ProgramData`, downloaded additional VBS components, and used renamed legitimate Windows utilities to blend into normal system activity. The intrusion chain then attempted **UAC bypass**, registry changes for persistence, and deployment of unsigned MSI installers including `Setup.msi`, `WinRAR.msi`, `LinkPoint.msi`, and `AnyDesk.msi`, which provided remote access and backdoor capability on compromised systems. Microsoft said the attackers abused living-off-the-land techniques such as renaming `curl.exe` and `bitsadmin.exe` while leaving original PE metadata intact, giving defenders a detection opportunity; the company also linked the activity to command-and-control domains **`neescil.top`** and **`velthora.top`** and published indicators, file hashes, and hunting guidance for defenders.
Jun 29, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
A campaign dubbed **Boss Scam** is targeting Indian enterprises by hijacking senior executives’ **WhatsApp Web** sessions and using the real accounts to send fraudulent payment requests. Attackers reportedly lure victims with urgent compliance-themed messages, including notices impersonating regulators such as the Reserve Bank of India, and deliver malicious ZIP archives that executives are tricked into forwarding to finance staff. Indian authorities said the scheme has led to rapid transfers to mule accounts, with some cases involving losses of up to **Rs. 2,45,00,000**. The ZIP files contain a legitimate signed executable paired with a malicious DLL that abuses **DLL sideloading** on Windows. Once executed, the malware can establish persistence, search Chromium-based browsers for active WhatsApp Web sessions, and steal cookies, authentication tokens, IndexedDB data, saved credentials, and encryption material; some reports say the data is archived with `tar.exe` and exfiltrated over TCP to clone the victim’s session. The attackers then impersonate executives or trusted employees to request wire transfers, spread additional malicious messages, or steal corporate information, and may fall back to saving an attacker-controlled number under the executive’s name if the hijacked session is cut off.
Jul 3, 2026