How can you recognize WhatsApp VBScript malware campaign spreads via hijacked contacts using fake financial documents?

Listen to the episode

TLDR

A new active malware campaign is spreading through WhatsApp Web and Desktop, using hijacked user accounts to send malicious VBScript (.vbs) files to contact lists worldwide. Victims receive a message with only an attachment and no text,...

How it works

Red flags

: Unexpected attachment from a known contact with no message or context File ending in .vbs (VBScript) disguised as a PDF, invoice, or statement File names in your local language referencing debts, payments, or tax forms you never requested

What to do

1: Never open .vbs , .js , .bat , or .exe files received via WhatsApp, even from trusted contacts Verify with the sender through a separate channel (call, in person) before opening any unexpected document Report the message, block the sender, and

Source

securelist

Source reviewed by Mythos Forensic Team

https://securelist.com/whatsapp-vbs-rmm-campaign/120290/

FAQ

Is WhatsApp VBScript malware campaign spreads via hijacked contacts using fake financial documents a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

: Unexpected attachment from a known contact with no message or context File ending in .vbs (VBScript) disguised as a PDF, invoice, or statement File names in your local language referencing debts, payments, or tax forms you never requested

What should I do first?

: Never open .vbs , .js , .bat , or .exe files received via WhatsApp, even from trusted contacts Verify with the sender through a separate channel (call, in person) before opening any unexpected document Report the message, block the sender, and

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.