WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool

A campaign is using WhatsApp to spread malicious Visual Basic Script files, which install legitimate Remote Monitoring and Management software. The files are being distributed through direct messages on WhatsApp Desktop and WhatsApp Web. The campaign is targeting users in several countries, including Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, and Australia. Kaspersky has identified this active campaign, which uses fake documents to install the ManageEngine RMM tool. The use of legitimate software in this campaign is a notable aspect of the attack. The campaign's scope is international, affecting users across multiple regions.