{"id":239454,"date":"2026-06-23T02:14:59","date_gmt":"2026-06-23T07:14:59","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/06\/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs"},"modified":"2026-06-23T02:14:59","modified_gmt":"2026-06-23T07:14:59","slug":"whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/06\/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs","title":{"rendered":"WhatsApp phishing attack uses fake business docs to hack PCs"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/whatsapp-phishing-attack-uses-fake-business-docs-to-hack-pcs.jpg\"><\/a><\/p>\n<p>An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access.<\/p>\n<p>The threat actor is using file names that indicate business and financial documents delivered by the victim\u2019s contacts, whose accounts had been compromised.<\/p>\n<p>By downloading and executing the malicious attachments, the recipient starts an infection chain that leads to installing the legitimate ManageEngine Endpoint Central, which is used by IT administrators to manage systems from a centralized dashboard.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. The threat actor is using file names that indicate business and financial documents delivered by the victim\u2019s contacts, whose accounts had been compromised. By downloading and executing the malicious attachments, the recipient [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43,34,45],"tags":[],"class_list":["post-239454","post","type-post","status-publish","format-standard","hentry","category-business","category-cybercrime-malcode","category-finance"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/239454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=239454"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/239454\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=239454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=239454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=239454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}