Back Feeds.4Sysops

WhatsApp phishing campaign exploits trusted contacts to install rogue RMM agents

Feeds.4Sysops •IT News • June 23, 2026

A global malware campaign is leveraging compromised WhatsApp accounts to distribute malicious VBScript files disguised as financial documents. Attackers target users of WhatsApp Desktop and WhatsApp Web, sending attachments like "Financial Reports.vbs" to the victim's existing list. By exploiting the inherent trust between known contacts, the campaign successfully bypasses traditional social engineering red flags to initiate a multi-stage infection chain. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Malware Campaign Distributes VBScript via Compromised WhatsApp Accounts In June 2026, a malware campaign was identified that spreads malicious VBScript files through WhatsApp direct messages. The campaign primarily targets users of WhatsApp Desktop and WhatsApp Web, with the highest number of victims in Malaysia. Attackers exploit compromised WhatsApp accounts to send deceptive messages containing attachments that appear as legitimate business documents, such as invoices and payment records. Once executed, the VBScript initiates a multi-stage infection chain that installs Remote Monitoring and Management (RMM) software, granting attackers remote access to the victims' systems. The campaign has affected users across multiple countries, including Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, and Vietnam. The threat actor's method of operation remains under investigation, with evidence suggesting extensive social engineering tactics. The campaign is still active as of the latest reports. 29 sources 70

Extracted Entities

WhatsApp phishing campaign exploits trusted contacts to install rogue RMM agents

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)