Attackers distribute VBScript files on WhatsApp to install remote access software

A campaign targeting WhatsApp Desktop and WhatsApp Web users distributes malicious VBScript files disguised as business and financial documents. Executing the files triggers an infection chain that installs ManageEngine RMM Central, enabling remote access to the system. The campaign has been observed in Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam, with the highest concentration of victims reported in Malaysia.