A VBScript campaign distributed through WhatsApp deploying RMM software

In June 2026 an active, cross-border campaign used compromised WhatsApp accounts to distribute obfuscated VBScript attachments that, when executed, download secondary scripts and install a preconfigured ManageEngine Endpoint Central RMM agent to enable persistent remote access; the campaign targeted users across multiple countries (≈80% of observed victims in Malaysia), employs UAC bypass attempts and multiple download mechanisms, and includes numerous IOCs (file hashes, domains, and IPs) with low-confidence attribution to a Chinese-speaking operator.