Attackers hijack WhatsApp accounts to send obfuscated VBScript files named as business or financial documents. When opened, the script disables UAC, downloads ManageEngine Endpoint Central, and connects the PC to attacker-controlled servers for remote administration. The campaign hits users in over a dozen countries, though how WhatsApp accounts are first compromised remains unclear.