WhatsApp Malware Campaign Spreads RMM Software

A global WhatsApp malware campaign uses compromised accounts to send localized VBScript invoice attachments that, when executed, create hidden working directories, download obfuscated payloads, attempt UAC bypass, extract a ManageEngine Endpoint Central deployment package, and silently install the RMM to gain persistent remote control; Kaspersky and Broadcom telemetry tie the active operation (notably affecting Malaysia) to prior RAT infrastructure (IP 202.61.160.201).