Attackers hijack WhatsApp accounts to send obfuscated VBScript files named as business or financial documents. When opened, the script disables UAC, downloads ManageEngine Endpoint Central, and connects the PC to attacker-controlled servers for remote administration. The campaign hits users in over a dozen countries, though how WhatsApp accounts are first compromised remains unclear.

This roundup covers a WhatsApp phishing campaign that uses fake business docs to drop remote-access malware on Windows PCs, Cisco’s move to secure AI agents by integrating WideField into Splunk, and why buying SaaS still beats building even with cheaper AI tools. It also highlights identity governance gaps for AI agents, Zoom Rooms’ expanded status dashboard, Flic Mic’s new wireless push-to-talk device, OpenAI’s Daybreak patch automation, and a terminal Markdown viewer called MdFried.

This digest covers a range of InfoSec news, from a Salesforce data theft via a compromised Klue integration and a mass phishing campaign impersonating Boots, to the discovery of GlassWASM WebAssembly malware hidden in trojanized Open VSX extensions. It also highlights red-teaming honey pot detection, recent ASUS driver CVEs, a Dropping Elephant loader chain, and Homebrew 6.0’s new security features.