![\"S\u01a1](\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/06\/whatsapp-vbs-inline.jpeg\")
Di\u1ec5n bi\u1ebfn ch\u00ednh c\u1ee7a chi\u1ebfn d\u1ecbch<\/h2>\n
Theo d\u1eef li\u1ec7u telemetry c\u1ee7a Kaspersky, chi\u1ebfn d\u1ecbch xu\u1ea5t hi\u1ec7n trong th\u00e1ng 6\/2026 v\u00e0 ch\u1ee7 y\u1ebfu nh\u1eafm v\u00e0o ng\u01b0\u1eddi d\u00f9ng WhatsApp Desktop ho\u1eb7c WhatsApp Web. T\u1ec7p \u0111\u1ed9c h\u1ea1i th\u01b0\u1eddng \u0111\u01b0\u1ee3c \u0111\u1eb7t t\u00ean gi\u1ed1ng c\u00e1c ch\u1ee9ng t\u1eeb quen thu\u1ed9c nh\u01b0 b\u00e1o c\u00e1o t\u00e0i ch\u00ednh, sao k\u00ea t\u00e0i kho\u1ea3n, th\u00f4ng b\u00e1o n\u1ee3, danh s\u00e1ch thanh to\u00e1n ho\u1eb7c bi\u1ec3u m\u1eabu kinh doanh. M\u1ed9t s\u1ed1 t\u00ean t\u1ec7p c\u00f2n \u0111\u01b0\u1ee3c b\u1ea3n \u0111\u1ecba h\u00f3a b\u1eb1ng nhi\u1ec1u ng\u00f4n ng\u1eef \u0111\u1ec3 t\u0103ng kh\u1ea3 n\u0103ng \u0111\u00e1nh l\u1eeba ng\u01b0\u1eddi d\u00f9ng \u1edf nhi\u1ec1u khu v\u1ef1c.<\/p>\n
Khi ng\u01b0\u1eddi d\u00f9ng t\u1ea3i v\u00e0 m\u1edf t\u1ec7p tr\u00ean Windows, VBScript kh\u1edfi ch\u1ea1y Windows Script Host r\u1ed3i t\u1ea3i th\u00eam c\u00e1c th\u00e0nh ph\u1ea7n t\u1eeb h\u1ea1 t\u1ea7ng do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t. C\u00e1c bi\u1ebfn th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e2n t\u00edch d\u00f9ng nhi\u1ec1u k\u1ef9 thu\u1eadt che gi\u1ea5u nh\u01b0 n\u1ed1i chu\u1ed7i, m\u00e3 h\u00f3a n\u1ed9i dung, \u0111\u1eb7t t\u00ean bi\u1ebfn ng\u1eabu nhi\u00ean v\u00e0 ch\u00e8n b\u00ecnh lu\u1eadn gi\u1ea3 m\u1ea1o th\u00e0nh ph\u1ea7n Windows Update.<\/p>\n
\u1ede giai \u0111o\u1ea1n ti\u1ebfp theo, m\u00e3 \u0111\u1ed9c c\u1ed1 g\u1eafng thay \u0111\u1ed5i thi\u1ebft l\u1eadp User Account Control th\u00f4ng qua Registry, \u0111\u1ed3ng th\u1eddi t\u1ea3i v\u1ec1 m\u1ed9t g\u00f3i ZIP ch\u1ee9a ManageEngine Endpoint Central. \u0110\u00e2y v\u1ed1n l\u00e0 ph\u1ea7n m\u1ec1m qu\u1ea3n tr\u1ecb thi\u1ebft b\u1ecb h\u1ee3p ph\u00e1p trong doanh nghi\u1ec7p, nh\u01b0ng trong chi\u1ebfn d\u1ecbch n\u00e0y b\u1ecb l\u1ea1m d\u1ee5ng \u0111\u1ec3 thi\u1ebft l\u1eadp kh\u1ea3 n\u0103ng \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa tr\u00ean m\u00e1y n\u1ea1n nh\u00e2n.<\/p>\n
V\u00ec sao h\u00ecnh th\u1ee9c n\u00e0y nguy hi\u1ec3m<\/h2>\n
Chi\u1ebfn d\u1ecbch k\u1ebft h\u1ee3p ba y\u1ebfu t\u1ed1 c\u00f3 s\u1ee9c thuy\u1ebft ph\u1ee5c cao: k\u00eanh nh\u1eafn tin quen thu\u1ed9c, t\u00e0i kho\u1ea3n g\u1eedi c\u00f3 th\u1ec3 l\u00e0 ng\u01b0\u1eddi trong danh b\u1ea1, v\u00e0 t\u00ean t\u1ec7p g\u1ee3i li\u00ean t\u01b0\u1edfng t\u1edbi c\u00f4ng vi\u1ec7c h\u00e0ng ng\u00e0y. V\u1edbi ng\u01b0\u1eddi d\u00f9ng ph\u1ed5 th\u00f4ng, m\u1ed9t t\u1ec7p c\u00f3 t\u00ean nh\u01b0 b\u00e1o c\u00e1o t\u00e0i ch\u00ednh ho\u1eb7c sao k\u00ea c\u00f4ng n\u1ee3 \u0111\u01b0\u1ee3c g\u1eedi t\u1eeb ng\u01b0\u1eddi quen c\u00f3 th\u1ec3 d\u1ec5 d\u00e0ng v\u01b0\u1ee3t qua l\u1edbp c\u1ea3nh gi\u00e1c ban \u0111\u1ea7u.<\/p>\n
R\u1ee7i ro c\u0169ng kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf vi\u1ec7c ch\u1ea1y m\u1ed9t script \u0111\u01a1n l\u1ebb. Sau khi ph\u1ea7n m\u1ec1m RMM \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t v\u00e0 tr\u1ecf v\u1ec1 m\u00e1y ch\u1ee7 do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t, h\u1ec7 th\u1ed1ng c\u00f3 th\u1ec3 b\u1ecb truy c\u1eadp t\u1eeb xa, theo d\u00f5i ho\u1ea1t \u0111\u1ed9ng, tri\u1ec3n khai th\u00eam m\u00e3 \u0111\u1ed9c ho\u1eb7c b\u1ecb d\u00f9ng l\u00e0m b\u00e0n \u0111\u1ea1p cho c\u00e1c h\u00e0nh vi x\u00e2m nh\u1eadp s\u00e2u h\u01a1n.<\/p>\n
Ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng v\u00e0 d\u1ea5u hi\u1ec7u k\u1ef9 thu\u1eadt<\/h2>\n
Kaspersky ghi nh\u1eadn n\u1ea1n nh\u00e2n t\u1ea1i Malaysia, Brazil, \u1ea4n \u0110\u1ed9, Mexico, Singapore, V\u01b0\u01a1ng qu\u1ed1c Anh, T\u00e2y Ban Nha, \u0110\u00e0i Loan, Australia, Nga, Vi\u1ec7t Nam v\u00e0 m\u1ed9t s\u1ed1 khu v\u1ef1c kh\u00e1c. B\u00e1o c\u00e1o cho bi\u1ebft ph\u1ea7n l\u1edbn n\u1ea1n nh\u00e2n quan s\u00e1t \u0111\u01b0\u1ee3c n\u1eb1m \u1edf Malaysia, nh\u01b0ng chi\u1ebfn d\u1ecbch c\u00f3 t\u00ednh ch\u1ea5t c\u01a1 h\u1ed9i v\u00e0 kh\u00f4ng th\u1ec3 hi\u1ec7n m\u1ee5c ti\u00eau ng\u00e0nh ngh\u1ec1 c\u1ee5 th\u1ec3.<\/p>\n
V\u1ec1 h\u1ea1 t\u1ea7ng, m\u1ed9t s\u1ed1 \u0111\u1ecba ch\u1ec9 m\u00e1y ch\u1ee7 qu\u1ea3n l\u00fd Endpoint Central \u0111\u01b0\u1ee3c Kaspersky li\u1ec7t k\u00ea c\u00f3 tr\u00f9ng l\u1eb7p v\u1edbi h\u1ea1 t\u1ea7ng t\u1eebng li\u00ean quan \u0111\u1ebfn ValleyRAT v\u00e0 Gh0st RAT. Tuy nhi\u00ean, nh\u00f3m nghi\u00ean c\u1ee9u ch\u1ec9 \u0111\u00e1nh gi\u00e1 \u1edf m\u1ee9c \u0111\u1ed9 tin c\u1eady th\u1ea5p v\u1ec1 kh\u1ea3 n\u0103ng li\u00ean quan \u0111\u1ebfn t\u00e1c nh\u00e2n n\u00f3i ti\u1ebfng Trung, do b\u1eb1ng ch\u1ee9ng hi\u1ec7n t\u1ea1i ch\u01b0a \u0111\u1ee7 \u0111\u1ec3 quy k\u1ebft ch\u1eafc ch\u1eafn.<\/p>\n
Recommendations for Users and Organizations<\/h2>\n
Ng\u01b0\u1eddi d\u00f9ng n\u00ean coi m\u1ecdi t\u1ec7p script v\u00e0 t\u1ec7p th\u1ef1c thi g\u1eedi qua \u1ee9ng d\u1ee5ng nh\u1eafn tin l\u00e0 r\u1ee7i ro cao, k\u1ec3 c\u1ea3 khi ch\u00fang \u0111\u1ebfn t\u1eeb ng\u01b0\u1eddi quen. C\u00e1c \u0111\u1ecbnh d\u1ea1ng nh\u01b0 VBS, VBE, EXE, BAT, CMD, JS v\u00e0 PS1 kh\u00f4ng n\u00ean \u0111\u01b0\u1ee3c m\u1edf n\u1ebfu ch\u01b0a x\u00e1c minh qua m\u1ed9t k\u00eanh \u0111\u1ed9c l\u1eadp.<\/p>\n
Doanh nghi\u1ec7p n\u00ean r\u00e0 so\u00e1t vi\u1ec7c s\u1eed d\u1ee5ng WhatsApp Desktop tr\u00ean m\u00e1y t\u00ednh l\u00e0m vi\u1ec7c, ch\u1eb7n th\u1ef1c thi script t\u1eeb th\u01b0 m\u1ee5c t\u1ea3i xu\u1ed1ng v\u00e0 th\u01b0 m\u1ee5c t\u1ea1m c\u1ee7a \u1ee9ng d\u1ee5ng nh\u1eafn tin, \u0111\u1ed3ng th\u1eddi gi\u00e1m s\u00e1t ti\u1ebfn tr\u00ecnh b\u1ea5t th\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn wscript.exe, msiexec.exe, bitsadmin.exe, certutil.exe, curl.exe v\u00e0 PowerShell. C\u00e1c c\u00f4ng c\u1ee5 EDR ho\u1eb7c antivirus c\u1ea7n \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt \u0111\u1ec3 ph\u00e1t hi\u1ec7n chu\u1ed7i h\u00e0nh vi t\u1ea3i script, thay \u0111\u1ed5i Registry v\u00e0 c\u00e0i \u0111\u1eb7t RMM kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t.<\/p>\n
V\u1edbi qu\u1ea3n tr\u1ecb vi\u00ean, c\u1ea7n ki\u1ec3m k\u00ea ph\u1ea7n m\u1ec1m RMM h\u1ee3p ph\u00e1p \u0111ang \u0111\u01b0\u1ee3c d\u00f9ng trong t\u1ed5 ch\u1ee9c \u0111\u1ec3 tr\u00e1nh nh\u1ea7m l\u1eabn gi\u1eefa ho\u1ea1t \u0111\u1ed9ng qu\u1ea3n tr\u1ecb th\u1eadt v\u00e0 d\u1ea5u hi\u1ec7u b\u1ecb l\u1ea1m d\u1ee5ng. Nh\u1eefng m\u00e1y xu\u1ea5t hi\u1ec7n Endpoint Central ho\u1eb7c agent qu\u1ea3n tr\u1ecb t\u1eeb xa ngo\u00e0i danh m\u1ee5c cho ph\u00e9p n\u00ean \u0111\u01b0\u1ee3c c\u00f4 l\u1eadp, ki\u1ec3m tra nh\u1eadt k\u00fd v\u00e0 \u0111\u1ed5i th\u00f4ng tin x\u00e1c th\u1ef1c li\u00ean quan.<\/p>\n
B\u00e0i h\u1ecdc an ninh t\u1eeb chi\u1ebfn d\u1ecbch WhatsApp VBScript<\/h2>\n
Chi\u1ebfn d\u1ecbch n\u00e0y cho th\u1ea5y t\u1ea5n c\u00f4ng qua \u1ee9ng d\u1ee5ng nh\u1eafn tin c\u00e1 nh\u00e2n v\u1eabn c\u00f3 th\u1ec3 t\u1ea1o t\u00e1c \u0111\u1ed9ng nghi\u00eam tr\u1ecdng tr\u00ean m\u00e1y t\u00ednh doanh nghi\u1ec7p n\u1ebfu ng\u01b0\u1eddi d\u00f9ng m\u1edf t\u1ec7p kh\u00f4ng ki\u1ec3m ch\u1ee9ng. Khi k\u1ebb t\u1ea5n c\u00f4ng l\u1ea1m d\u1ee5ng ph\u1ea7n m\u1ec1m h\u1ee3p ph\u00e1p, vi\u1ec7c ph\u00e1t hi\u1ec7n kh\u00f4ng c\u00f2n d\u1ef1a \u0111\u01a1n thu\u1ea7n v\u00e0o t\u00ean ti\u1ebfn tr\u00ecnh m\u00e0 c\u1ea7n nh\u00ecn v\u00e0o ng\u1eef c\u1ea3nh: ngu\u1ed3n t\u1ea3i, \u0111\u01b0\u1eddng d\u1eabn th\u1ef1c thi, m\u00e1y ch\u1ee7 k\u1ebft n\u1ed1i v\u00e0 quy\u1ec1n qu\u1ea3n tr\u1ecb \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u.<\/p>\n
Trong m\u00f4i tr\u01b0\u1eddng l\u00e0m vi\u1ec7c hi\u1ec7n \u0111\u1ea1i, ranh gi\u1edbi gi\u1eefa k\u00eanh c\u00e1 nh\u00e2n v\u00e0 thi\u1ebft b\u1ecb c\u00f4ng vi\u1ec7c ng\u00e0y c\u00e0ng m\u1edd. V\u00ec v\u1eady, ch\u00ednh s\u00e1ch b\u1ea3o m\u1eadt c\u1ea7n k\u1ebft h\u1ee3p \u0111\u00e0o t\u1ea1o nh\u1eadn di\u1ec7n t\u1ec7p nguy hi\u1ec3m, ki\u1ec3m so\u00e1t th\u1ef1c thi script, qu\u1ea3n tr\u1ecb quy\u1ec1n c\u00e0i ph\u1ea7n m\u1ec1m v\u00e0 gi\u00e1m s\u00e1t h\u00e0nh vi sau khi t\u1ec7p \u0111\u01b0\u1ee3c m\u1edf.<\/p>\n
VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer v\u00e0 Securelist\/Kaspersky<\/em><\/p>","protected":false},"excerpt":{"rendered":" M\u1ed9t chi\u1ebfn d\u1ecbch m\u00e3 \u0111\u1ed9c \u0111ang l\u1ee3i d\u1ee5ng WhatsApp \u0111\u1ec3 ph\u00e1t t\u00e1n t\u1ec7p VBScript gi\u1ea3 d\u1ea1ng t\u00e0i li\u1ec7u kinh doanh v\u00e0 t\u00e0i ch\u00ednh, sau \u0111\u00f3 c\u00e0i ph\u1ea7n m\u1ec1m qu\u1ea3n tr\u1ecb t\u1eeb xa h\u1ee3p ph\u00e1p nh\u1eb1m m\u1edf \u0111\u01b0\u1eddng cho k\u1ebb t\u1ea5n c\u00f4ng truy c\u1eadp h\u1ec7 th\u1ed1ng n\u1ea1n nh\u00e2n. Theo BleepingComputer v\u00e0 b\u00e1o c\u00e1o k\u1ef9 thu\u1eadt c\u1ee7a […]<\/p>\n","protected":false},"author":2,"featured_media":1685,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[246,250,244,15,247,38,177,245,249,243,242,248],"class_list":["post-1687","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bleepingcomputer","tag-gh0st-rat","tag-kaspersky","tag-ma-doc","tag-manageengine-endpoint-central","tag-phishing","tag-rmm","tag-securelist","tag-valleyrat","tag-vbscript","tag-whatsapp","tag-windows-script-host"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1687"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1687\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1685"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}