WhatsApp Scammers Send Malicious Docs

A widespread phishing campaign is targeting WhatsApp users by sending malicious VBScript files masquerading as business or financial documents. Security researchers have noted that these files, once executed on Windows systems, deploy scripts that disable User Account Control protections and install ManageEngine's Endpoint Central. This legitimate unified endpoint management platform is exploited to grant attackers remote system access.

The campaign's global reach is attributed in part to localized filenames, which have fooled users in countries such as Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia. While researchers have confirmed the distribution method via compromised WhatsApp accounts, the initial method of breaching these accounts is still under investigation.

Users who download the files via WhatsApp Web must first download them, whereas the desktop client allows direct execution through Windows Script Host. This ongoing threat highlights the need for vigilance against suspicious document-sharing, even from known contacts.