MyCERT Warns of WhatsApp VBS Scam Hitting Windows Users in Malaysia

Malaysia’s Computer Emergency Response Team, MyCERT, published an alert on 22 June 2026 about an active malware campaign that delivers Visual Basic Script files through WhatsApp messages, a WhatsApp VBS scam that specifically targets users of WhatsApp Web and WhatsApp Desktop on Windows. The agency said the file will run automatically if opened using WhatsApp Desktop or WhatsApp Web on a Windows computer, and that the malware has been observed installing a Remote Access Trojan that gives the attacker hands-on control of the infected machine.

The advisory lists lure file names such as “Acknowledgment of Debt.vbs”, “Sila semak bil anda.vbs”, “December statement of account.vbs”, and “Reconciliation.vbs”, each styled to look like a routine invoice or financial document rather than a script. Kaspersky’s parallel research on the same campaign, published the same month, puts Malaysia at the top of the victim count, ahead of Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, Australia, Russia and Vietnam.

What MyCERT Just Told Malaysians

MyCERT’s advisory frames the campaign as highly targeted at individuals using WhatsApp Desktop or WhatsApp Web on Microsoft Windows, and it is unusually specific about what does and does not count as exposure. The risk is entirely confined to Windows environments, the agency said; Visual Basic Script files do not execute on iOS, Android, macOS or Linux devices, and the WhatsApp mobile applications will not download or process .vbs attachments as executable files.

The attackers contact victims directly through WhatsApp and rely on social engineering rather than technical exploits. They send a single attachment disguised as a financial, legal or administrative document, and on WhatsApp Desktop the file can be opened with a second click from the chat itself, after which the malware begins the infection process. MyCERT also warned that recipients should not reply to the sender at all, because replying confirms that the phone number is active and live, and the agency instructed users to report the message on WhatsApp and to Cyber999 with a screenshot, a timestamp and the sender’s number.

What a .vbs File Does When Opened

Once executed, the .vbs file does not stay a .vbs file for long. According to MyCERT’s advisory, the script silently installs a ManageEngine Endpoint Central remote monitoring agent on the infected Windows machine, an attacker-controlled tool that establishes persistent remote access. The agent installs itself as a Windows service so it survives reboots, and the malware disables Windows security prompts so that subsequent malicious actions run without triggering user consent dialogs or alerts.

Because the agent runs as a service, a standard antivirus scan often fails to detect or remove it, which is why MyCERT told affected users to seek professional removal rather than rely on consumer security software. Anything visible on the infected screen is treated as exposed: passwords typed on the device, banking PINs entered on it, and one-time passwords displayed for online banking all fall into the attacker’s hands.

Kaspersky’s write-up of the same campaign breaks the infection into three stages, each one quietly dropping more capability onto the victim machine. The table below summarises what each stage does, drawn from the Securelist analysis.

Who’s Actually in the Blast Radius

Read at the surface, this is a warning to anyone who uses WhatsApp on a Windows PC. The hidden stakeholder is corporate IT. The RAT installs as a Windows service, evades standard antivirus scans, and gives the attacker the same hands-on access a helpdesk technician would have, which is exactly the access profile an attacker needs to move laterally inside an organisation. MyCERT tells users on a corporate-issued device to notify their IT team as soon as the device is suspected to be compromised, and treats every password, PIN and OTP typed on the machine as already breached.

The second hidden stakeholder is the WhatsApp contact list. Kaspersky reports that the messages carrying the malicious attachments were sent from already-compromised WhatsApp accounts, often with no accompanying text, and that one compromised account was seen sending the same attachment to multiple contacts from its list. The method used to compromise those WhatsApp accounts remains unknown at the time of Kaspersky’s write-up, but the consequence is that the lure often arrives from a number the recipient already trusts.

The third stakeholder is anyone whose exposure path runs through WhatsApp Web rather than the desktop app. According to Kaspersky’s telemetry, opening the .vbs from WhatsApp Web requires an extra step: the user must open the downloaded file from the Windows Downloads folder or from the browser’s download history, at which point Windows Script Host launches the script and the chain begins. That extra click is the only thing standing between a Web user and a Desktop user, and both end up in the same place.

What to Do If You’ve Already Clicked

MyCERT instructs users who have executed the file to assume the device is compromised and to follow the steps below, in order. None of these steps depends on confirming that the file “looked” malicious after the fact; the agency treats opening as equivalent to compromise.

1. Disconnect from the internet immediately to cut off the attacker’s remote access while the device is still in their hands.
2. Notify your IT team if the device is corporate-issued, and prepare for a professional reimage rather than a clean-up scan.
3. From a separate clean device, change every password associated with accounts used on the infected machine, including banking and email.
4. Treat all passwords, PINs and one-time passwords typed or displayed on the infected device as exposed, even if you did not see anything happen.
5. Do not reply to the sender, then report the message on WhatsApp and to MyCERT at cyber999@cybersecurity.my with the screenshot, timestamp and sender number.

How Kaspersky and Microsoft Tracked It

Kaspersky says it observed the campaign in June 2026 across multiple countries and territories, with Malaysia recording the highest number of victims, and described the operation as still active at the time of publication. The lure file names were localised into several languages, including Malay (“Penyata bank.vbs”, “Sila semak bil anda.vbs”), Portuguese, French and German, which Kaspersky reads as evidence of a single threat actor running the campaign across regions rather than separate local groups.

Microsoft Defender Experts had already flagged the same family earlier in the year, observing a campaign beginning in late February 2026 that used WhatsApp messages to deliver malicious Visual Basic Script and MSI backdoors. The Microsoft write-up, dated 31 March 2026, lines up with Kaspersky’s later findings on the ManageEngine Endpoint Central delivery mechanism, and gives defenders a second independent timeline to anchor incident response against.

Why This Still Works in 2026

None of the underlying techniques are new. What makes this campaign land is the combination of a trusted sender, a familiar file name, and an attachment type that almost no consumer is trained to recognise. The lure names reference invoices, debt notices, payment records and bank statements, the exact category of file a finance or admin worker is conditioned to open without thinking, and the .vbs extension is hidden in plain sight because Windows often hides extensions by default.

Kaspersky also notes that the VBScript samples carry extensive comments and metadata intended to mimic legitimate Microsoft Windows Update components, with many of those comments written in Chinese and referring to certificate validation, system integrity checks and deployment-related functionality. That camouflage buys the script a few extra seconds of unquestioned execution on a machine that has already been told to trust “Windows Update” by default.

The user interaction required is small. On WhatsApp Desktop, two clicks inside the chat are enough: one to download the attachment, one to open it. On WhatsApp Web, the user has to leave the browser tab and launch the file from the Downloads folder, which adds a step without adding real scrutiny. Either way, the script reaches Windows Script Host through WhatsApp’s own process tree, and the chain starts before most users have a chance to read the file name.

Frequently Asked Questions

Does the WhatsApp VBS scam affect iPhone or Android users?

No. MyCERT’s advisory states explicitly that Visual Basic Script files do not execute on iOS, Android, macOS or Linux devices, and that WhatsApp’s mobile apps do not download or process .vbs attachments as executable files. The risk is entirely confined to Windows machines running WhatsApp Web or WhatsApp Desktop.

I opened the file by accident. What now?

Treat the device as compromised. Disconnect it from the internet immediately, then change every account password associated with that device from a separate clean machine, and treat every password, PIN and one-time password typed or displayed on the infected machine as already exposed. MyCERT recommends bringing the device to a professional for removal because a standard antivirus scan is unlikely to detect or remove the Remote Access Trojan.

Will antivirus remove the RAT?

Probably not. MyCERT says the agent installs itself as a Windows service and that standard antivirus scans often fail to detect or remove it. Kaspersky’s analysis of the same family shows the agent using a renamed copy of legitimate ManageEngine Endpoint Central software, which makes signature-based detection harder.

Why is Malaysia the most-hit country?

Kaspersky’s research attributes the count to local targeting in the lure file names (“Sila semak bil anda.vbs”, “Penyata bank.vbs”) and to distribution through compromised Malaysian WhatsApp accounts, which spreads the lures to contacts already inside the country. The agency says the campaign is active in at least eleven countries, with Malaysia at the top of the victim list.

How do I report a malicious WhatsApp message to MyCERT?

Email cyber999@cybersecurity.my with a screenshot of the WhatsApp message, the timestamp and the sender’s number, and report the message inside WhatsApp by long-pressing the chat and selecting Report. Cyber999 also accepts phone reports at 1-300-88-2999 during business hours and at +60 19 2665850 for 24×7 incident calls.