WhatsApp Phishing Campaign Uses Fake Business Documents to Install Remote-Access Software
Summary
Kaspersky reports that compromised WhatsApp accounts are spreading disguised VBScript files. On Windows, the files launch scripts that install ManageEngine Endpoint Central configured for attacker-controlled remote access; links to ValleyRAT and Gh0st RAT infrastructure
Key points
- Compromised WhatsApp accounts sent obfuscated VBScript attachments disguised as invoices, account notices, and financial reports.
- Kaspersky observed the campaign in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.
- On Windows, the VBScript fetches additional scripts that modify the Registry to disable UAC protections and download a ZIP archive.
- The archive contains ManageEngine Endpoint Central, which is silently installed and configured to connect to attacker-controlled management servers for remote administration.
- Files opened in WhatsApp Desktop can execute through Windows Script Host; files delivered via WhatsApp Web must first be downloaded.
- Kaspersky says the method used to compromise WhatsApp accounts is unknown. Researchers found language and infrastructure overlaps with activity associated with ValleyRAT and Gh0st RAT, but said evidence is insufficient for high-confidence attribution.
Article Details
- Event Type
- Malware campaign distributing malicious VBScript attachments through compromised WhatsApp accounts
- Impact
- Opening the attachments starts an infection chain that disables UAC protections, downloads additional scripts and a ZIP archive, and silently installs ManageEngine Endpoint Central configured to connect to attacker-controlled management servers. This gives attackers remote administration access to victims’ computers.
MITRE ATT&CK
T1059.005 · Visual BasicThe infection chain uses VBScript files and additional scripts.T1105 · Ingress Tool TransferThe VBScript fetches additional scripts and downloads a ZIP archive from attacker infrastructure.T1112 · Modify RegistryAdditional scripts modify Registry settings to disable UAC protections.T1204.002 · Malicious FileThe infection chain begins when a victim opens the malicious file.T1219 · Remote Access ToolsManageEngine Endpoint Central is configured to connect to attacker-controlled management servers for remote administration.T1548.002 · Bypass User Account ControlThe scripts disable UAC protections through Registry modifications.
Malware
Gh0st RATWhen opened, the files trigger an infection chain that installs ManageEngine Endpoint Central for remote access, with Kaspersky noting possible links to ValleyRAT and Gh0st RAT infrastructure.ValleyRATWhen opened, the files trigger an infection chain that installs ManageEngine Endpoint Central for remote access, with Kaspersky noting possible links to ValleyRAT and Gh0st RAT infrastructure.
Products
ManageEngine Endpoint CentralWhen opened, the files trigger an infection chain that installs ManageEngine Endpoint Central for remote access, with Kaspersky noting possible links to ValleyRAT and Gh0st RAT infrastructure.WhatsAppA malware campaign is abusing compromised WhatsApp accounts to send obfuscated VBScript files disguised as business and financial documents across multiple countries.
Countries
AustraliaThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.BrazilThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.IndiaThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.MalaysiaThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.MexicoThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.RussiaThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.SingaporeThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.SpainThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.TaiwanThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.United KingdomThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.VietnamThe campaign has been observed in Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.