VBScript (Visual Basic Scripting Edition) is a Microsoft scripting language from 1996, built into Windows, that attackers have long abused to deliver malware through email attachments and downloads.
How VBScript works
VBScript is a lightweight language derived from Visual Basic. Script files with the .vbs extension are run by Windows Script Host (wscript.exe or cscript.exe) with a double click, and the language was also embedded in Internet Explorer web pages and classic ASP websites. Administrators used it for login scripts and automation before PowerShell replaced it.
Microsoft has deprecated VBScript: it was disabled by default in Internet Explorer in 2019, turned into an optional “feature on demand” in Windows 11 version 24H2, and is scheduled to be removed from Windows entirely in a future release.
Why VBScript matters for security
Because VBScript runs natively on every Windows computer, it has been a favourite attacker tool, listed in MITRE ATT&CK as T1059.005 (Command and Scripting Interpreter: Visual Basic):
- ILOVEYOU (2000) – a VBScript worm sent as LOVE-LETTER-FOR-YOU.TXT.vbs that infected millions of computers within days.
- Email attachments – .vbs files, often hidden in ZIP archives or disguised with double extensions, act as a first-stage malware loader that downloads banking trojans, infostealers or ransomware.
- Office macros – VBA in macro malware is a close relative and frequently drops VBScript files.
- Browser exploits – vulnerabilities in the IE VBScript engine were used in drive-by attacks.
Since wscript.exe is a legitimate Windows component, such attacks are also a form of living off the land.
How to protect against VBScript abuse
- Remove the VBScript feature where it is no longer needed and plan for its removal.
- Block .vbs, .vbe and .wsf attachments at the email gateway.
- Associate script extensions with Notepad so a double click does not execute them.
- Use application control to restrict wscript.exe and cscript.exe.
