WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
By [email protected] (The Hacker News)
AI Summary
An active campaign identified by Kaspersky is distributing malicious VBScript files via WhatsApp Desktop and WhatsApp Web messages across at least nine countries including Malaysia, Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, and Australia, ultimately installing ManageEngine RMM software for unauthorized remote access. The use of a legitimate RMM tool as the payload helps the malware evade detection and persist under the guise of trusted software. Security teams should add detection rules for unsanctioned ManageEngine deployments and alert on VBScript execution originating from messaging application contexts.
Relevance score: 77.0/100
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →