31 OCT 2026 — Singapore's Cyber Security Agency (CSA) warned on 28 October that malicious files are being passed around through hijacked WhatsApp accounts, so the files appear to come from people the recipients know. Four days earlier, Malaysia's national computer emergency team, MyCERT, had published a detailed alert on a campaign in which fake banking documents quietly install a genuine, digitally signed IT management tool and hand control of the computer to an attacker.
MyCERT reverse-engineered the files in its lab. CSA, through SingCERT, relayed what users had reported and borrowed MyCERT's checklist for spotting an infection.
What arrives on WhatsApp
According to the Singapore advisory, SingCERT "has received multiple reports" of such files. They may pass for business documents and exploit the trust people place in known contacts. In the reported cases, people who opened a file later found that similar files had gone out to their own contacts "without their knowledge or authorisation". CSA does not say how many reports it received.
MyCERT's alert of 24 October describes the files in more detail. They arrive as ZIP archives, often protected by a password, each holding one file named to look like a document, such as a PDF. Most names are banking-related, e-statements for example. The file is really a Windows virtual disk image in the .vhdx or .iso format. Files inside a mounted disk image do not carry the marker Windows puts on downloads, MyCERT explains, so fewer warnings appear.
MyCERT says the delivery channel "was not consistently established across the samples analysed", but its public advice puts WhatsApp and other messaging apps first.
A real admin tool, aimed elsewhere
When the victim opens the disk image and runs the file inside, a small signed tool from another software maker loads a malicious library. That library raises its own privileges, downloads a second stage, and silently installs ManageEngine's UEMS Agent 6.0.3, which companies use to manage their own computers. Forged "ManageEngineCA" root certificates go in alongside it, making the encrypted traffic look vendor-signed. The agent then enrols with a server the attacker controls.
The result, in MyCERT's words, is "full, credentialed remote control of the victim device". Because the lures are banking-themed, MyCERT says affected users should treat their online banking, e-wallet and payment-app credentials as compromised.
The agent is dangerous precisely because it is legitimate. "Because the implant is a genuine, digitally signed vendor product, signature-based detection alone will not identify it," MyCERT writes. What gives it away is where the agent reports to, not who signed it. ManageEngine is not accused of anything. Its product is being abused, and MyCERT tells users they may contact ManageEngine support for help removing it.
Who is behind it is not established
MyCERT titles its alert "SilverFox Campaign", but the name is a tracking label belonging to the security firm Kaspersky, and MyCERT says its naming follows Kaspersky's. It adds that "no confirmed link to any named threat group has been established." MyCERT judges its three builds to be the work of one operator.
In June, both Kaspersky and MyCERT described an earlier WhatsApp campaign that used a script file, rather than a disk image, to install a ManageEngine agent. Kaspersky's June report found infections in several countries, Singapore and Vietnam among them, "with 80% of the victims located in Malaysia". It said it was unable to confidently attribute that activity to a known group. MyCERT's 22 June alert warned about the same kind of script lures.
The two advisories, side by side
Singapore's notice names WhatsApp as the route in reported cases, and warns that attackers could take over WhatsApp Web sessions to send the files on, and watch victims' online banking. Its wording is hedged: what the attackers could do, CSA says, depends "on the type of malware involved".
The technical checks are borrowed. CSA lists five host indicators, credited to MyCERT and copied word for word, and one still points to "the backend addresses in Section 4.0", a section that exists only in MyCERT's document. CSA's own list of risky file endings is .exe, .iso and .zip. It omits .vhdx, which MyCERT lists first among the disk formats used here.
MyCERT says Kaspersky shared a register of 151 unique archive hashes seen as the first stage of the campaign in September and October. By our count MyCERT's page carries 155 SHA-256 values, four in its own file-indicator table and 151 in the register. None of the 151 repeats, none matches the four, and the two containers MyCERT says it found in the register are both there. The stated figure holds. We do not reproduce the hashes.
What the agencies tell users
Both agencies say not to open unexpected files, even from a known contact, and to check with the sender by phone or another channel first. MyCERT adds that a .vhdx, .iso or .vhd file is a disk image, never a document.
CSA advises anyone who has opened such a file to disconnect the device, scan it with antivirus software and warn their contacts. It also says to review WhatsApp's linked devices and turn on two-step verification. Unauthorised bank transactions should be reported to the bank and the police. MyCERT says to change passwords using another, uninfected device and to report it through its Cyber999 service. It warns that ManageEngine software you did not install is suspicious, and that a standard uninstall "will not remove the certificates the implant adds".
Checks for IT teams
MyCERT asks organisations to list every machine running a ManageEngine UEMS or Endpoint Central agent and confirm where each one reports. Any enrolment that does not match the organisation's own setup is "presumptive compromise". An infected machine should be isolated and rebuilt from clean media, because uninstalling the agent is not enough. It also suggests restricting the mounting of disk images from user-writable folders and alerting on new ManageEngineCA root certificates and outbound connections on TCP port 8383.
