WhatsApp VBScript Campaign Installs ManageEngine Endpoint Central for Remote Access

Jun 22, 2026 · Original article ↗

Summary

A June 2026 campaign used financial-themed VBScript attachments sent via WhatsApp to install ManageEngine Endpoint Central for remote access. Victims were observed in multiple countries, with 80% in Malaysia; attribution remains uncertain.

Key points

Malicious attachments sent through WhatsApp direct messages used financial-themed filenames to trick recipients into opening VBS or VBE files.
Researchers observed the campaign in multiple countries; 80% of victims in their telemetry were in Malaysia. The campaign was still active at the time of reporting.
The scripts ran through Windows Script Host, downloaded additional VBScript payloads, and used obfuscation and misleading file extensions.
A later stage downloaded a ZIP archive and attempted to change a Windows UAC registry setting; applying the change required administrative privileges.
The final script silently installed a bundled ManageEngine Endpoint Central agent, enabling remote administration of victim systems.
The researchers linked distribution to compromised WhatsApp accounts, but said the method used to compromise those accounts was unknown.
Chinese-language script comments and infrastructure overlap with systems associated with ValleyRAT and Gh0st RAT suggested possible Chinese-speaking involvement, but did not establish attribution.

Article Details

Attack Vectors: Malicious VBS/VBE attachments were sent through WhatsApp direct messages, often from compromised accounts and disguised as financial or business documents.
Opening an attachment in WhatsApp Desktop or WhatsApp Web launched the script through Windows Script Host.
The scripts downloaded further VBScript payloads and a ZIP archive containing a preconfigured ManageEngine Endpoint Central agent, which was silently installed.
Defensive Notes: Treat unexpected WhatsApp attachments cautiously, even when sent by a known contact.
Do not open VBS, VBE, EXE, BAT, CMD, JS, or PS1 files unless their legitimacy has been independently verified.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`baoxis[.]cc`	Listed as campaign-related attacker-controlled download infrastructure.
DOMAIN	`invoice[.]msopsa[.]top`	Attacker-controlled download infrastructure used in the campaign.
DOMAIN	`temu[.]baskwms[.]top`	Attacker-controlled download infrastructure used in the campaign.
HOSTNAME	`baoyuw2s[.]s3[.]ap-southeast-1[.]amazonaws[.]com`	Specific cloud-storage hostname listed as a domain indicator for the campaign.
HOSTNAME	`sdcwww[.]oss-ap-southeast-1[.]aliyuncs[.]com`	Specific cloud-storage hostname listed as a domain indicator for the campaign.
HOSTNAME	`sjdkjj23[.]s3[.]ap-southeast-1[.]amazonaws[.]com`	Specific cloud-storage hostname listed as a domain indicator for the campaign.
HOSTNAME	`xijkwm2[.]s3[.]ap-southeast-1[.]amazonaws[.]com`	Specific cloud-storage hostname listed as a domain indicator for the campaign.
HOSTNAME	`yifubafu[.]s3[.]ap-southeast-1[.]amazonaws[.]com`	Specific cloud-storage hostname listed as a domain indicator for the campaign.
IPV4	`202[.]61[.]160[.]137`	Listed as an attacker-controlled Endpoint Central management server configured in the deployment package.
IPV4	`202[.]61[.]160[.]160`	Listed as an attacker-controlled Endpoint Central management server configured in the deployment package.
IPV4	`202[.]61[.]160[.]201`	Listed as an attacker-controlled Endpoint Central management server; the article notes prior association with ValleyRAT and Gh0st RAT infrastructure but says attribution is unconfirmed.
IPV4	`202[.]61[.]160[.]202`	Listed as an attacker-controlled Endpoint Central management server configured in the deployment package.
IPV4	`202[.]61[.]160[.]208`	Listed as an attacker-controlled Endpoint Central management server configured in the deployment package.
IPV4	`38[.]55[.]151[.]63`	Listed as an attacker-controlled Endpoint Central management server configured in the deployment package.
MD5	`02bb20455cc592a69c080abac770ce90`	MD5 hash of the malicious VBScript sample named Le formulaire de demande le plus rÃ©cent .vbs.
MD5	`05d188f071d097f5b6bd8138749b4b14`	MD5 hash of the malicious VBScript sample named Penyata bank.vbs.
MD5	`1d94fbe9cab21278cc3f104bea334d08`	MD5 hash of the malicious VBScript sample named Promissory_Note(b).vbs.
MD5	`5b6bbcc06cf08cc99e1afeda486d42fb`	MD5 hash of the malicious VBScript sample named Extrato de ConciliaÃ§Ã£o.vbs.
MD5	`66442f2457eca8f47385b1fb2c6fcab8`	MD5 hash of the malicious VBScript sample named Statement of Debt(30K).vbs.
MD5	`68c16c46f8afb9e00bbaba0207fb0a46`	MD5 hash of the malicious VBScript sample named Debt Note (2).vbs.
MD5	`7403cbcc5a9c32384d431856dc48fcc9`	MD5 hash of the malicious VBScript sample named Statement of debt (4).vbs.
MD5	`74fd9f91fc93b6288b4fc253ea5b3e20`	MD5 hash of the malicious VBScript sample named Sila semak bil anda.vbs.
MD5	`7f81c1bc8cfd588e8998968e2621456e`	MD5 hash of the malicious VBScript sample named Outstanding Payment List.vbs.
MD5	`993f4c0cadbc769a4b0ed62a918db58d`	MD5 hash of the malicious VBScript sample named Financial Reports(s).vbs.
MD5	`9f13c7b8ba391b2f597874e54d310648`	MD5 hash of the malicious VBScript sample named Electronic statement(A).vbs.
MD5	`b7cd06c71465038b658a6dc1f273a507`	MD5 hash of the malicious VBScript sample named Debt confirmation.vbs.
MD5	`c7f38cbb99c8b74fa0465293feeba700`	MD5 hash of the malicious VBScript sample named Financial Reports.vbs.
MD5	`d01cad98dd0d01b75e04e784953c5e2b`	MD5 hash of the malicious VBScript sample named sleestak_payload_1.vbs.
MD5	`df4fa0369eaca5cec348be293890d4af`	MD5 hash of the malicious VBScript sample named Account Statement.vbs.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe scripts used string concatenation, encoded VBScript, randomized variable names, and junk content to obscure their functionality.T1036 · MasqueradingAttachment names imitated financial documents, while script comments and metadata mimicked Windows Update components.T1059.005 · Visual BasicVBScript payloads were executed through Windows Script Host to download and launch later stages.T1078 · Valid AccountsThe campaign used compromised WhatsApp accounts to send malicious attachments to contacts; the article does not describe how the accounts were compromised.T1105 · Ingress Tool TransferThe scripts downloaded additional VBScript payloads and a ZIP archive containing the Endpoint Central installation package from campaign infrastructure.T1112 · Modify RegistryA Stage 2 script attempted to change the ConsentPromptBehaviorAdmin registry value.T1204.002 · Malicious FileThe infection began when a recipient opened a deceptive VBS attachment in WhatsApp Desktop or opened the downloaded file from WhatsApp Web.T1219 · Remote Access ToolsThe campaign silently installed a preconfigured ManageEngine Endpoint Central agent to enable remote administration of victim systems.T1548.002 · Bypass User Account ControlScripts used the runas mechanism and attempted to set ConsentPromptBehaviorAdmin to 0 to reduce UAC consent prompts; the registry change required administrative privileges.T1564.001 · Hidden Files and DirectoriesSome variants set hidden and system attributes on the staging directory and downloaded files.T1566.003 · Spearphishing via ServiceMalicious attachments were delivered to contacts through WhatsApp direct messages, often from compromised accounts.

Vendors

ManageEngineThe scripts used financial-themed lures and a multi-stage infection chain that ended with the silent installation of ManageEngine Endpoint Central for remote access.

Products

ManageEngine Endpoint CentralThe scripts used financial-themed lures and a multi-stage infection chain that ended with the silent installation of ManageEngine Endpoint Central for remote access.WhatsAppA June 2026 campaign spread malicious VBScript attachments through WhatsApp direct messages to users in multiple countries, with Malaysia seeing the highest number of victims.

Countries