WhatsApp phishing attack hacks PC using fake business documents

An ongoing malware marketing campaign is focusing on WhatsApp customers in a number of nations with misleading messages that push VBScript information to lure them into distant system entry.

Attackers are utilizing filenames that point out enterprise and monetary paperwork delivered by contacts of victims whose accounts have been compromised.

As soon as the malicious attachment is downloaded and executed, the recipient begins the an infection chain and installs the respectable ManageEngine Endpoint Central, which IT directors use to handle programs from a central dashboard.

The marketing campaign has unfold to Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia, in response to telemetry knowledge from cybersecurity agency Kaspersky Lab.

assault chain

Kaspersky stories that the assault begins with a message despatched from a compromised account that incorporates solely a extremely obfuscated VBS file.

These information have names that make them seem like monetary stories, billing statements, account notifications, and related paperwork, that are more likely to catch the goal’s consideration and immediate them to open the file.

The filenames are additionally localized into a number of languages, additional supporting the worldwide attain of the marketing campaign.

Sample malicious message — **Pattern malicious message**
*Supply: Kaspersky*

“Based mostly on proof collected from a number of victims via social media stories and submitted samples, we will conclude that the attackers gained entry to a number of WhatsApp accounts and used them to distribute malicious VBScript information to contacts within the contact lists of compromised customers,” Kaspersky defined.

“On the time of writing, the precise technique used to compromise these WhatsApp accounts remains to be unknown.”

When the sufferer downloads and opens the file in Home windows, VBScript retrieves two extra scripts from the attacker’s infrastructure. This disables UAC safety via registry modifications and downloads a ZIP archive containing the ManageEngine Endpoint Central program.

**ZIP file contents**
*Supply: Kaspersky*

The software program installs silently within the background and is configured to hook up with an attacker-controlled administration server, permitting distant administrative entry on the sufferer’s laptop.

Kaspersky says that the preliminary VBScript file should be downloaded whether it is delivered through WhatsApp Internet, however when opened within the WhatsApp desktop shopper it may be executed immediately through Home windows Script Host (wscript.exe).

Attack chain overview — **Assault chain overview**
*Supply: Kaspersky*

Whereas Kaspersky Lab has not attributed this assault to a selected actor, researchers discovered indicators of Chinese language language use and overlap in IPs and infrastructure beforehand related to ValleyRAT and Gh0st RAT exercise.

Nevertheless, there’s inadequate proof to permit dependable attribution.

WhatsApp customers are suggested to watch out with information despatched by contacts, even trusted ones, and at all times confirm them via secondary means.

All downloaded information ought to be scanned with up-to-date antivirus software program earlier than execution.