An unknown actor distributes malicious VBS scripts via WhatsApp | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish Brazil Solutions Internet of Things & Embedded Security Learn More Industrial Cybersecurity Learn More Fraud Prevention Learn More KasperskyOS-based solutions Learn More Other solutions Kaspersky for Security Operations Center Kaspersky IoT Infrastructure Security Kaspersky Secure Remote Workspace Industries National Cybersecurity Learn More Industrial Cybersecurity Learn More Finance Services Cybersecurity Learn More Healthcare Cybersecurity Learn More Transportation Cybersecurity Learn More Retail Cybersecurity Learn More Other Industries Telecom Cybersecurity View all Products Kaspersky Next NEW! Learn More Kaspersky XDR Learn More Kaspersky Endpoint Security for Business Learn More Kaspersky EDR Expert Learn More Kaspersky EDR Optimum Learn More Kaspersky Anti Targeted Attack Platform Learn More Kaspersky Hybrid Cloud Security Learn More Kaspersky SD-WAN Learn More Kaspersky Industrial CyberSecurity Learn More Kaspersky Container Security Learn More Other Products Kaspersky Security for Internet Gateway Kaspersky Embedded Systems Security Kaspersky IoT Infrastructure Security Kaspersky Secure Remote Workspace Kaspersky Security for Mail Server View All Services Kaspersky Cybersecurity Services Learn More Kaspersky Security Awareness Learn More Kaspersky Premium Support Learn More Kaspersky Threat Intelligence Learn More Kaspersky Managed Detection and Response Learn More Kaspersky Compromise Assessment Learn More Kaspersky SOC Consulting Learn More Other Services Kaspersky Professional Services Kaspersky Incident Response Kaspersky Cybersecurity Training View All Resource Center Case Studies White Papers Datasheets Technologies MITRE ATT&CK About Us Transparency Corporate News Press Center Careers Sponsorship Policy Blog Contacts GDPR Subscribe --> Dark mode off Login --> Securelist menu English Russian Spanish Brazil Existing Customers Personal My Kaspersky Renew your product Update your product Customer support Business KSOS portal Kaspersky Business Hub Technical Support Knowledge Base Renew License Home Products Trials&Update Resource Center Business Kaspersky Next Small Business (1-50 employees) Medium Business (51-999 employees) Enterprise (1000+ employees) Securelist Threats Financial threats Mobile threats Web threats Secure environment (IoT) Vulnerabilities and exploits Spam and Phishing Industrial threats Categories APT reports Incidents Research Malware reports Spam and phishing reports Publications Kaspersky Security Bulletin Archive All Tags APT Logbook Webinars Statistics Encyclopedia Threats descriptions KSB 2021 About Us Company Transparency Corporate News Press Center Careers Sponsorships Policy Blog Contacts Partners Find a Partner Partner Program Content menu Close Subscribe Threat Response by Kaspersky Dark mode off Threats Threats APT (Targeted attacks) Secure environment (IoT) Mobile threats Financial threats Spam and phishing Industrial threats Web threats Vulnerabilities and exploits All threats Categories Categories APT reports Malware descriptions Security Bulletin Malware reports Spam and phishing reports Security technologies Research Publications All categories Other sections Threat Response All tags Webinars APT Logbook Statistics Encyclopedia Threats descriptions KSB 2025 Kaspersky ICS CERT GReAT research A VBScript campaign distributed through WhatsApp deploying RMM software GReAT research 22 Jun 2026 minute read Fareed Radzi Table of Contents Social engineering through financial-themed file names Delivery of the initial VBScript file Technical analysis Stage 1: Initial VBScript execution Stage 2: Execution of secondary VBScript payloads VBS script 1: UAC configuration modification VBS script 2: ZIP download and script execution Stage 3: Installation of remote monitoring and management software Victimology and attribution Conclusion IOCs VBScript Domains Attacker-controlled UEMS server IP Address Authors Fareed Radzi In June 2026, we observed a malware campaign distributing malicious VBScript files through direct messages in WhatsApp. The campaign affected users across multiple countries and territories, including Malaysia, Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia and Vietnam, with the highest number of victims observed in Malaysia. At the time of writing this article, the campaign is still active. Analysis shows that the campaign primarily targets users of WhatsApp Desktop and WhatsApp Web. The threat actor uses deceptive file names masquerading as business and financial documents to persuade recipients to download and execute the attachment. Once executed, the VBScript initiates a multi-stage infection chain that ultimately results in the installation of legitimate Remote Monitoring and Management (RMM) software, enabling remote access to the victim’s system. Overview of the WhatsApp-based VBScript infection chain We came across a number of social media posts reporting that the malware was being distributed by the users’ contacts. The messages contained only the malicious attachment and did not include any accompanying text. One account sent the same attachment to multiple contacts from their list. WhatsApp messages containing the malicious VBScript file observed across multiple accounts. Source: alleged victims’ posts on social media Based on evidence collected from multiple victims through social media reports and submitted samples, we can conclude that the threat actor had gained access to several WhatsApp accounts and used them to distribute the malicious VBScript files to contacts on the compromised users’ contact lists. At the time of writing, the exact method used to compromise these WhatsApp accounts remains unknown. Social engineering through financial-themed file names Analysis of the samples revealed that the threat actor relied heavily on social engineering through the use of deceptive file names designed to appear as legitimate business and financial documents. The file names frequently referenced invoices, account statements, debt notices, payment records, and bank statements. Examples of file names include: Financial Reports.vbs Debt confirmation.vbs Statement of Debt(30K).vbs Outstanding Payment List.vbs Account Statement.vbs Debt Statement.vbs Billing Statement (2).vbs Promissory_Note(b).vbs Several file names were also localized into different languages, including Portuguese, French, German, and Malay. Examples include: Extrato de Conciliação.vbs Aviso de dívida.vbs Le formulaire de demande le plus récent.vbs Bitte füllen Sie das Formular für Umsatzsteuer-Nullsatz-Verkäufe aus.vbs Penyata bank.vbs Sila semak bil anda.vbs The use of multiple languages further suggests that the campaign may be targeting victims across different geographic regions. In addition, the VBScript samples contain extensive comments and metadata intended to mimic legitimate Microsoft Windows Update components. Many of these comments are written in Chinese and include references to Windows Update modules, certificate validation, system integrity checks, and deployment-related functionality. The screenshot below shows an example of the Windows Update–themed comments and Chinese-language annotations embedded within one of the analyzed scripts. Windows Update–themed and Chinese-language comments observed across multiple Stage 1 VBScript variants Delivery of the initial VBScript file Analysis of telemetry collected from the systems where the malware was executed, conducted together with the dynamic analysis of the sample, showed that the VBScript is launched through Windows Script Host (WScript.exe), which subsequently retrieves and executes additional VBScript components required for the later stages of the attack. Two user interactions are needed to initiate the infection chain. When the user first clicks the attachment in either WhatsApp Desktop or WhatsApp web, it is downloaded to their machine. To launch the app, they need to open it. In WhatsApp Desktop, the malware is executed directly within the application by clicking the file icon after downloading it or by choosing the “Open” option in the chat. The process tree analysis shows that WScript.exe is spawned by WhatsApp.Root.exe. The executed script was observed within WhatsApp Desktop’s attachment storage directory, with the following command line: "C:\Windows\System32\WScript.exe" "C:\Users\<username>\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\<session_identifier>\Transfers\<YYYY-MM>\financial reports(s).vbs" 1 "C:\Windows\System32\WScript.exe" "C:\Users\<username>\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\Sessions\<session_identifier>\Transfers\<YYYY-MM>\financial reports(s).vbs" This process relationship confirms that the malicious VBScript was executed directly from the WhatsApp Desktop client. In contrast, when the attachment is accessed through WhatsApp Web, to launch the malware, the user should open the downloaded file from the Downloads folder or through the browser’s download history. In the first case, the malware’s parent process will be explorer.exe, while in the second, it will be executed by the browser where the web app was opened. Technical analysis Stage 1: Initial VBScript execution The first stage of the infection chain is a VBS or VBE file delivered through WhatsApp. Although multiple variants of the scripts were observed, their core functionality remains consistent: the script creates a working directory under C:\Users\Public\Documents\ , downloads two additional VBScript payloads from a remote infrastructure, and executes them using Windows Script Host. Across the observed variants, the working directory is created using randomized names such as Temp_<random> or MSUpdate_<random> . Some variants also configure the directory and downloaded files with hidden and system attributes, likely to reduce visibility to the user during execution. Example of the code generating a random working directory and configuring it with hidden and system attributes The scripts employ several obfuscation techniques, including string concatenation, encoded VBScript, randomized variable names, and large amounts of junk content. One notable variant employs even heavier obfuscation than the other samples. The script reconstructs object names, file paths, utilities, and URLs through character-by-character string concatenation. Example of an obfuscated Stage 1 VBScript variant. Several variants copy curl.exe and bitsadmin.exe into the working directory and rename them using DLL-like filenames before downloading additional VBS files. Example of the Stage 1 downloader logic using renamed Windows utilities and multiple download mechanisms to retrieve additional VBS files The downloaded files are commonly staged using misleading file extensions before execution. For example, some variants download files using PDF or TXT extensions and then change them to VBS before launching them with wscript.exe. Other variants download the secondary VBScript payloads directly. Despite differences in infrastructure, file names, and obfuscation methods, all observed variants ultimately perform the same function: downloading and executing two secondary VBScript payloads that continue the infection chain. Stage 2: Execution of secondary VBScript payloads Following execution, the Stage 1 VBScript downloads and launches two additional VBScript files from attacker-controlled infrastructure. One script attempts to modify Windows User Account Control (UAC) settings, while the other downloads and executes a ZIP archive containing the installation package for a RMM software. VBS script 1: UAC configuration modification First Stage 2 scripts were observed attempting to modify Windows UAC behavior. Stage 2 VBScript repeatedly attempting to modify the ConsentPromptBehaviorAdmin registry value As shown in the figure above, the script repeatedly executes an elevated registry modification command targeting the following registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin 1 HKLM \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ ConsentPromptBehaviorAdmin The command is launched using the ShellExecute method with the runas verb, causing Windows to request administrative privileges before the registry change can be applied. Its goal is to set the ConsentPromptBehaviorAdmin registry key value to 0, thus enabling administrative actions without displaying a consent prompt to the user. The script attempts to apply this registry change in a loop with short delays between executions, likely to increase the chances that the setting will be successfully modified if administrative privileges are granted by the victim. VBS script 2: ZIP download and script execution The second VBS script downloads a ZIP file, extracts it and executes a script to start the RMM installation. Similar to the Stage 1 downloader, the Stage 2 downloader creates its own working directory under C:\Users\Public\Documents\ , commonly using randomized folder names such as Sys<random> , Data<random> , or a random numeric value. In most cases, the hidden attribute is assigned to this folder. The script then downloads a ZIP archive from attacker-controlled infrastructure, extracts its contents, and executes an embedded setup1.vbs script. Stage 2 downloader creating a hidden working directory under C:\Users\Public\Documents\ Similar to the Stage 1 downloader, the variants leverage multiple download mechanisms, including curl, bitsadmin, certutil, PowerShell, and direct HTTP requests. Stage 2 downloader using multiple download mechanisms to retrieve the ZIP archive Following a successful download, the archive is extracted using the Shell.Application COM interface. Most variants invoke the CopyHere method with flags intended to suppress user prompts and allow extraction to proceed without user interaction. The extracted setup1.vbs script is then launched through wscript.exe to proceed with the next stage of the infection chain. Also, one variant additionally attempts to remove Zone.Identifier alternate data streams from extracted files prior to execution, likely to reduce security warnings associated with files downloaded from the Internet. Example of the code responsible for ZIP extraction, Zone.Identifier removal, and execution of the next-stage VBScript Stage 3: Installation of remote monitoring and management software Besides the setup1.vbs script, the ZIP archive downloaded during Stage 2 contains a preconfigured ManageEngine Endpoint Central deployment package. Inside the archive are the files required to install and register the Endpoint Central agent, including the MSI installer, configuration files, certificates, and installation scripts. Extracted Stage 3 Endpoint Central installation ZIP package The table below summarizes the purpose of each file contained within the deployment package: File Description DCAgentServerInfo.json Endpoint Central server configuration containing management server IP addresses and ports DMRootCA.crt Trusted root certificate DMRootCA-Server.crt Server authentication certificate README.html Endpoint Central agent setup instructions setup.bat Legitimate Endpoint Central installer wrapper included in the package, not used by the malware chain setup1.vbs Malicious launcher used by the threat actor to silently install the Endpoint Central agent UEMSAgent.msi Endpoint Central agent installer package UEMSAgent.mst Custom installation configuration settings for the MSI package ManageEngine Endpoint Central is a legitimate enterprise management platform commonly used for software deployment, system administration, and remote support. Its remote administration capabilities make it attractive for abuse by threat actors seeking persistent access to compromised systems. One interesting variant attempted to disguise the package as an income tax–related document. Instead of containing a legitimate tax document, the archive contained a VBScript file named “Income Tax Return Form.vbs” and accompanied by an instruction file designed to persuade the victim to open it. Analysis showed that the VBScript contained functionality similar to setup1.vbs, ultimately performing the same Endpoint Central installation process. Tax document-themed VBScript lure and installation script As discussed in Stage 2, the downloader ultimately executes a VBScript file named setup1.vbs. The script first verifies that the required installation files are present in the extracted folder and then attempts to relaunch itself with administrative privileges using the Windows runas mechanism before proceeding with the installation. The setup1.vbs script verifying installation files and requesting administrative privileges Once elevated, setup1.vbs silently installs the bundled ManageEngine Endpoint Central agent using msiexec.exe, applying the supplied configuration and certificate files. The installation is performed silently, preventing the user from seeing the Endpoint Central installation interface. Endpoint Central agent installation via msiexec.exe Analysis of the embedded DCAgentServerInfo.json configuration file revealed the following Endpoint Central management servers: 202.61.160[.]208 202.61.160[.]202 202.61.160[.]201 202.61.160[.]160 202.61.160[.]137 38.55.151[.]63 Notably, 202.61.160[.]201 had previously been observed as command-and-control infrastructure associated with ValleyRAT and Gh0st RAT activity. Although the overlap raises the possibility of the VBS campaign being linked to the operator of these known malware families, the available evidence is insufficient to confidently attribute the campaign to a known threat actor. Victimology and attribution Based on our telemetry, infections were observed across several countries and territories, including Malaysia, Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia, and Vietnam, with 80% of the victims located in Malaysia. The campaign primarily relied on malicious VBScript attachments distributed through WhatsApp and appeared to target individual users rather than specific organizations or industries. At the time of the analysis, no evidence suggested a focused targeting strategy, instead indicating a broad, opportunistic campaign aimed at consumers. We were unable to confidently attribute this activity to a known threat actor or intrusion set. However, several artifacts observed throughout the campaign point to a possible Chinese-speaking threat actor. Multiple VBScript samples contained comments, module descriptions, and execution notes written in simplified Chinese characters. These comments appeared consistently across different variants, suggesting that the scripts were likely developed or maintained by a Chinese-speaking operator. We also identified infrastructure overlaps with IP addresses previously associated with ValleyRAT and Gh0st RAT activity. While these overlaps may indicate infrastructure reuse or shared hosting resources, they are not sufficient to establish a direct connection to any known threat actor. Based on the available evidence, we assess with low confidence that the campaign was conducted by a Chinese-speaking operator. Additional investigation, infrastructure overlaps, or operational indicators would be required to support a stronger attribution assessment. Conclusion This campaign uses compromised WhatsApp accounts to distribute malicious VBScript attachments that ultimately install a preconfigured ManageEngine Endpoint Central agent on victim systems. Observed victims were located across multiple countries and territories, including Malaysia, Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia, and Vietnam, suggesting a broad and opportunistic campaign. Users should be cautious when receiving unexpected attachments through WhatsApp, even when they appear to originate from known contacts. Script and executable file types such as VBS, VBE, EXE, BAT, CMD, JS, and PS1 should not be opened unless their legitimacy has been independently verified. IOCs VBScript c7f38cbb99c8b74fa0465293feeba700 Financial Reports.vbs b7cd06c71465038b658a6dc1f273a507 Debt confirmation.vbs 9f13c7b8ba391b2f597874e54d310648 Electronic statement(A).vbs 993f4c0cadbc769a4b0ed62a918db58d Financial Reports(s).vbs 7f81c1bc8cfd588e8998968e2621456e Outstanding Payment List.vbs 7403cbcc5a9c32384d431856dc48fcc9 Statement of debt (4).vbs 68c16c46f8afb9e00bbaba0207fb0a46 Debt Note (2).vbs 66442f2457eca8f47385b1fb2c6fcab8 Statement of Debt(30K).vbs 6359e6236471cbe434d0ef4c42b7f879 Applicationform1.vbs 5b6bbcc06cf08cc99e1afeda486d42fb Extrato de Conciliação.vbs 5002eca748205d544618e3bd2dedc223 Statement of Debt(29K).vbs 4f0593e8e0e8fac49429e9b45ebf7fa1 Outstanding Payment List.vbs 4044e4b6471c9de7b0a4ba37d9d9df9a billing statement (2).vbs 20209b3a32769afc6a75694b8d8839dd Statement of Debt(A).vbs 0ba93109757776a44de9d8c88baa4963 Financial Reports(C1).vbs 02bb20455cc592a69c080abac770ce90 Le formulaire de demande le plus récent .vbs 6c39900d77dcba158e1d27c7619cb06d Outstanding Balance Sheet(A).vbs dad708e050632a4280cabf98ac1376b7 Outstanding Balance Sheet.vbs 05d188f071d097f5b6bd8138749b4b14 Penyata bank.vbs 2c6f05f1f309d89b2236e6c8b59c88f9 Account Statement（13K） (2).vbs 3b1aba44dd3d9b6339b6f56e2f42034b Statement of Account.txt d43fdaa1f0ee09d7e5f0f94ee9df7b6c Bitte füllen Sie das Formular für Umsatzsteuer-Nullsatz-Verkäufe aus.vbs df4fa0369eaca5cec348be293890d4af Account Statement.vbs 63ac85195b73753333316a889cf5880f Statement of Account(O).vbs 74fd9f91fc93b6288b4fc253ea5b3e20 Sila semak bil anda.vbs d06333c360b51456f427e616c3c5f8bd Sila semak bil anda.vbs 993f4c0cadbc769a4b0ed62a918db58d FinancialReportsS.vbs 1d94fbe9cab21278cc3f104bea334d08 Promissory_Note(b).vbs 9d9ac85765e4a818a3ccabe2cf4fef82 Debt Statement.vbs 6fb6a55424adfb61e31f06aef33273e5 dfjieya.vbs f90ed4b2d0b67114aa89ddfed658e5c0 dfjieya.vbs 8c3322009b8982663c0cbecd9492e7eb 0lf.vbs 66705384a7ad81d14c34fc6c054a0ecf iowepv.vbs 8c6d9fc389ad3f20ccbc71d77eb39bfa btksfmsi.vbs 1a3cc75466ffb1971482f7abf7aabc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037a42ca048e06e69a78f55bc2eff5 1122.vbs 7f16449cd0c4862d1eadf8a5742bf09a payload_1.vbs 79ecd61b09b0f2d54b34586c916c4ec9 sac8.vbs 7849061c536a3efb05a56d504694e7e7 6oy.vbs ddaffe9849f7f3c79f8804adb9a6b3d5 kof.vbs d01cad98dd0d01b75e04e784953c5e2b sleestak_payload_1.vbs Domains temu.baskwms[.]top invoice.msopsa[.]top qse.shoppes[.]help shaaslong[.]one baoxis[.]cc baolongwes.oss-ap-southeast-1.aliyuncs[.]com sdcwww.oss-ap-southeast-1.aliyuncs[.]com baoyuw2s.s3.ap-southeast-1.amazonaws[.]com hksha3.s3.ap-southeast-1.amazonaws[.]com sjdkjj23.s3.ap-southeast-1.amazonaws[.]com xijkwm2.s3.ap-southeast-1.amazonaws[.]com yifubafu.s3.ap-southeast-1.amazonaws[.]com caiwuascw.s3.us-east-005.backblazeb2[.]com facaia.s3.us-east-005.backblazeb2[.]com Attacker-controlled UEMS server IP Address 202.61.160[.]202 202.61.160[.]201 202.61.160[.]137 202.61.160[.]160 202.61.160[.]208 38.55.151[.]63 Malware Technologies Microsoft Windows Malware Descriptions Malware WhatsApp VBS RMM A VBScript campaign distributed through WhatsApp deploying RMM software Your email address will not be published. Required fields are marked * Name * Email * Captcha validation failed. Please confirm you are not a robot and try again. Cancel Δ This site uses Akismet to reduce spam. Learn how your comment data is processed. Gaojin Posted on June 23, 2026. 12:47 am The proliferation of social engineering attacks akin to those attributed to the Silver Fox threat actor underscores a growing trend—such remote-access threats are certain to become increasingly prevalent. Reply Artem Posted on June 23, 2026. 2:20 pm To be honest, in 2026, this attack vector looks literally ridiculous… executing .vbs on modern Windows 11, are you serious? How many warnings should the user skip to execute it, even with Windows Defender disabled? I’m not an expert in Silver Fox TA’s arsenal, but assume they target users of (very) old (read ancient) Windows versions. Moreover, starting next year, VBScript will become an optional feature, turned off by default. Reply Table of Contents Social engineering through financial-themed file names Delivery of the initial VBScript file Technical analysis Stage 1: Initial VBScript execution Stage 2: Execution of secondary VBScript payloads VBS script 1: UAC configuration modification VBS script 2: ZIP download and script execution Stage 3: Installation of remote monitoring and management software Victimology and attribution Conclusion IOCs VBScript Domains Attacker-controlled UEMS server IP Address From the same authors StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns No need to RSVP: a closer look at the Tria stealer campaign In the same category The Gentlemen are knocking: сustom backdoors and evolving tactics StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader Argamal: Malware hidden in hentai games Wardriving assessment across Mexico: Preparing for the 2026 World Cup How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) Latest Posts Publications OpenClaw: risks for the users and how to mitigate them Kaspersky APT reports ToddyCat: your hidden email assistant. Part 2 Andrey Gunkin GReAT research The Gentlemen are knocking: сustom backdoors and evolving tactics Fatih Şensoy Maher Yamout Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk Valery Akulenko Latest Webinars Technologies and services 02 Jun 2026, 5:00pm 60 min AI meets cybersecurity: Powering the next digital move Vladislav Tushkanov Oleg Gorobets Anton Rusakov-Rudenko Technologies and services 21 May 2026, 11:00am 60 min Automate your SOC with Kaspersky XDR 2.0 Dmitry Berezin Brandon Muller Trainings and workshops 05 May 2026, 5:00pm 47 min How do we catch 0-days? Boris Larin Trainings and workshops 30 Apr 2026, 2:00pm 61 min SOC evolution: From firefighting to strategic risk management Roman Nazarov Alexander Mazikin Alexander Marmalidi Reports ToddyCat: your hidden email assistant. Part 2 An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services. Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload Cloud Atlas attacks the public sector and diplomatic structures of Russia and Belarus, using ReverseSocks, SSH, and Tor for persistence in infected systems and its new tool, PowerCloud. Kimsuky targets organizations with PebbleDash-based tools Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster. OceanLotus suspected of using PyPI to deliver ZiChatBot malware Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Subscribe to our weekly e-mails The hottest research right in your inbox Email (Required) Captcha (Required) I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. Subscribe Δ Threats Threats APT (Targeted attacks) Secure environment (IoT) Mobile threats Financial threats Spam and phishing Industrial threats Web threats Vulnerabilities and exploits All threats Categories Categories APT reports Malware descriptions Security Bulletin Malware reports Spam and phishing reports Security technologies Research Publications All categories Other sections Threat Response All tags Webinars APT Logbook Statistics Encyclopedia Threats descriptions KSB 2025 Kaspersky ICS CERT © 2026 AO Kaspersky Lab. All Rights Reserved. Registered trademarks and service marks are the property of their respective owners. Privacy Policy Terms of use License Agreement Cookies

📌 来源: Kaspersky Securelist | 📅 2026-06-22