{"id":3784,"date":"2026-06-22T10:04:26","date_gmt":"2026-06-22T10:04:26","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/22\/a-vbscript-campaign-distributed-through-whatsapp-deploying-rmm-software\/"},"modified":"2026-06-22T10:04:26","modified_gmt":"2026-06-22T10:04:26","slug":"a-vbscript-campaign-distributed-through-whatsapp-deploying-rmm-software","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/22\/a-vbscript-campaign-distributed-through-whatsapp-deploying-rmm-software\/","title":{"rendered":"A VBScript campaign distributed through WhatsApp deploying RMM software"},"content":{"rendered":"
\n

\"\"<\/p>\n

In June 2026, we observed a malware campaign distributing malicious VBScript files through direct messages in WhatsApp. The campaign affected users across multiple countries and territories, including Malaysia, Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia and Vietnam, with the highest number of victims observed in Malaysia. At the time of writing this article, the campaign is still active.<\/p>\n

Analysis shows that the campaign primarily targets users of WhatsApp Desktop and WhatsApp Web. The threat actor uses deceptive file names masquerading as business and financial documents to persuade recipients to download and execute the attachment. Once executed, the VBScript initiates a multi-stage infection chain that ultimately results in the installation of legitimate Remote Monitoring and Management (RMM) software, enabling remote access to the victim\u2019s system.<\/p>\n

\"Overview<\/a><\/p>\n

Overview of the WhatsApp-based VBScript infection chain<\/p>\n<\/div>\n

We came across a number of social media posts reporting that the malware was being distributed by the users\u2019 contacts. The messages contained only the malicious attachment and did not include any accompanying text. One account sent the same attachment to multiple contacts from their list.<\/p>\n

\"WhatsApp<\/a><\/p>\n

WhatsApp messages containing the malicious VBScript file observed across multiple accounts. Source: alleged victim posts on social media<\/p>\n<\/div>\n

Based on evidence collected from multiple victims through social media reports and submitted samples, we can conclude that the threat actor had gained access to several WhatsApp accounts and used them to distribute the malicious VBScript files to contacts on the compromised users\u2019 contact lists. At the time of writing, the exact method used to compromise these WhatsApp accounts remains unknown.<\/p>\n

Social engineering through financial-themed file names<\/h2>\n

Analysis of the samples revealed that the threat actor relied heavily on social engineering through the use of deceptive file names designed to appear as legitimate business and financial documents. The file names frequently referenced invoices, account statements, debt notices, payment records, and bank statements.
\nExamples of file names include:<\/p>\n