WhatsApp Phishing Hijacks PCs With Real IT Admin Software

A malware campaign spreading through WhatsApp has a clever wrinkle. Instead of dropping the usual custom malware on victim machines, the attackers are installing legitimate IT administration software and using it to take the wheel. Kaspersky has been tracking the activity across Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam and Malaysia.

The message comes from someone you know

The chain starts with a WhatsApp message from a real contact whose account has been compromised. Attached is a heavily obfuscated VBScript file, dressed up as a financial report, invoice or account notice. Filenames are localised by region, which is a big part of why the lure works. The sender is genuine, the document looks like the sort of thing they might plausibly send, and the brain fills in the rest.

What happens when you open it

On Windows, the script reaches out for two more files. Those quietly disable User Account Control through registry changes and pull down a ZIP archive containing ManageEngine Endpoint Central. That is not malware in the traditional sense. It is a real, commercial product used by IT teams to manage fleets of machines from a central dashboard. Installed silently and pointed at the attacker's servers rather than the company's own, it hands them the same remote administration powers a sysadmin would have. They can deploy software, run commands, pull files, and generally treat the machine as their own.

There is a small wrinkle around delivery. If the file arrives through WhatsApp Web in a browser, the victim has to manually download and open it. In the WhatsApp Desktop client, the script can be executed directly through Windows Script Host, which removes one of the few speed bumps a curious user might otherwise hit.

Who is behind it

Kaspersky found Chinese-language artefacts in the tooling and noted infrastructure overlap with ValleyRAT and Gh0st RAT, both long-running remote access tools associated with Chinese-speaking actors. They stopped short of attributing the campaign to a specific group, which is the responsible call when the evidence is circumstantial.

Why the social trick matters more than the technical one

The technical side is interesting. Living off legitimate software is harder for endpoint tools to flag than a bespoke trojan, because nothing on disk is inherently malicious. But the part worth holding onto is the social mechanic. The campaign works because a familiar name in the From field acts as a trust shortcut. The contact is real. The conversation history is real. The document looks plausible. None of that is verification.

A thirty-second voice note or a quick call to the supposed sender, before opening anything unusual, breaks the entire chain. The attackers can spoof the filename, the framing and the context. They cannot, yet, spoof a colleague's voice telling you they did not send anything.