Cybercriminals have found a new delivery vehicle for their digital intrusions — and it sits on the phones and desktops of billions of people worldwide. A sophisticated social engineering campaign is currently exploiting WhatsApp, one of the planet's most widely used messaging platforms, to distribute malicious Visual Basic Script (VBScript) files disguised as legitimate documents. The payload? A stealthy installation of a commercially available Remote Monitoring and Management (RMM) tool that hands attackers persistent, under-the-radar access to compromised systems.
Living Off Trusted Land
What makes this campaign particularly dangerous is its abuse of legitimacy at every layer. WhatsApp carries an inherent trust factor — users expect messages from known contacts, and that assumption of safety is exactly what threat actors are exploiting. By sending what appear to be routine document files through WhatsApp Desktop and WhatsApp Web, attackers sidestep the instinctive caution users might apply to suspicious emails or unfamiliar websites.
Once opened, the VBScript file initiates a chain of execution that culminates in the silent deployment of ManageEngine, a widely recognized RMM platform used legitimately by IT teams globally. This tactic — known as "living off trusted tools" — allows attackers to blend into normal network activity, making detection by traditional security controls significantly harder.
"When malware hides behind a commercially trusted application, it doesn't just evade detection — it actively mimics the behavior of your own IT team."
A Global Footprint
The geographic spread of this campaign signals a broad, opportunistic operation rather than a narrowly targeted strike. Confirmed activity has been identified across Malaysia, Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, and Australia — a constellation of targets spanning Asia-Pacific, Europe, and the Americas. The diversity of regions suggests the attackers are not pursuing a specific geopolitical objective, but are instead maximizing victim count across high-connectivity, high-device-density markets.
This pattern aligns with financially motivated threat actors who prioritize scale. RMM access to even a fraction of compromised endpoints can yield significant returns — whether through data exfiltration, ransomware staging, credential harvesting, or lateral movement within corporate networks.
Why RMM Tools Are the Attacker's Swiss Army Knife
Remote Monitoring and Management software is designed for IT administrators to manage endpoints at scale — executing commands, transferring files, monitoring system health, and accessing machines remotely. In legitimate hands, it's an indispensable operational tool. In the wrong hands, it becomes a fully functional remote access trojan (RAT) that carries a trusted digital signature.
Security teams often whitelist RMM platforms by default. Behavioral detection engines may not flag their activity as anomalous. And without rigorous endpoint telemetry and application control policies, the unauthorized presence of such software can go unnoticed for weeks or months — ample time for attackers to establish persistence, exfiltrate sensitive data, or prepare a more destructive follow-on attack.
The VBScript Delivery Mechanism
VBScript remains a persistent threat vector despite Microsoft's long-running efforts to deprecate it. In this campaign, the script likely performs several preparatory functions: establishing communication with attacker-controlled infrastructure, downloading RMM installer components, and suppressing visible installation prompts to keep the victim unaware. The use of a seemingly benign document as the lure exploits user expectations around file safety — particularly when received through a trusted messaging channel rather than email.
What You Should Do
The Broader Lesson
This campaign is a sharp reminder that attackers are continuously identifying new vectors in the seams between trusted platforms and complacent users. WhatsApp's ubiquity makes it an attractive distribution channel precisely because its trust profile is so high. As messaging apps increasingly blur the line between personal and professional use, organizations can no longer treat them as outside the threat landscape.
Defenders must extend their threat models to encompass every communication channel employees use — and ensure that the lure of apparent legitimacy, whether it's a familiar app icon or a recognizable software brand, is never sufficient justification to lower one's guard.
