Early October 2025,Trend Micro(Trend Micro) research team revealed an active in BrazilMalwareoffensive operations, this campaign exploitsWhatsAppAs the main infection channel, it quickly spreads between enterprises and individuals. This attack named “Water Saci”, codenamed SORVEPOTEL, can automatically spread malicious ZIP files through compromised WhatsApp accounts to further infect more users. Unlike previous attacks that simply stole data or extorted money, this operation is characterized by “Speed and self-reproduction”. Trend Micro pointed out that the main purpose of this wave of attacks is toLeveraging social trust and automationSpreads rapidly among Windows systems and starts withBrazilian Business and Financial Institutionsas the primary goal.
A new self-propagating malicious program “SORVEPOTEL” appears in Brazil, spreading through WhatsApp to attack companies and financial institutions
Attackers send phishing messages containing ZIP compressed files through compromised contact accounts. The file names are usually disguised as everyday files, such as “RES-20250930_112057.zip” or “ORCAMENTO_114418.zip”, and encourage recipients in Portuguese to “download and open on your computer.” There is actually aWindows Shortcut (.LNK) File. Once executed by the victim, the shortcut launches a PowerShell script in the background that downloads the main malicious program from a server controlled by the hacker. These malicious domain names are such assorvetenoopote[.]com、expahnsiveuser[.]cometc. At first glance, they look similar to legitimate websites, which is misleading.
After decoding, the script will be connected to the command and control server (C&C), download the next stage batch file (.BAT), and create it in the systemcontinuous activation mechanism, ensuring that it is automatically executed every time the computer is turned on. Because the source of the message appears to be an acquaintance, the victim often lowers his or her guard, and the infection chain begins. In addition to WhatsApp, Trend Micro also observede-mailAs a secondary infection route, phishing emails use themes such as “Comprovante” and “Documento de Rafael” to trick recipients into opening attachments.
Once the malicious script runs on the system, it will detect whether WhatsApp Web is open on the computer. If it detects that the user is logged in, SORVEPOTEL willAutomatically use this conversation to send the same ZIP file to all contacts and groups,accomplishself-propagation. This resulted in a large amount of spam messages flooding into WhatsApp servers, and many accounts were suspended or banned as a result. Trend Micro’s monitoring shows that so far, a total of 477 related infection cases have been detected around the world, including457 cases occurred in Brazil. Victims are not limited to general users;Government units, public services, manufacturing, technology, education and construction industriesand other fields.
Technical details: multi-layered payloads and information theft
(1) The first stage: PowerShell and .NET loading
The initial batch file downloads and executes a PowerShell script and reflectively loads a .NET DLL module. This module connects to two specific URLs, downloads two different sets of malicious payloads, and uses an anti-analysis mechanism to detect common debugging tools (such as IDA, Wireshark, Burp Suite, etc.). If it passes the test, the program will start fromzapgrande[.]comThe server obtains the encrypted Shellcode and injects itpowershell_ise.exeExecuted in the process to further launch the subsequent attack stage.
(2) Second stage: Maverick.StageTwo Trojan
This stage mainly performs information theft and persistence operations. The malicious program will create a file named “HealthApp-XXXXXX.bat” and put it in the startup folder to disguise it as a health application. It continuously monitors the user’s browser activity, specifically detecting whether to accessBrazilian bank website, such as Bradesco, Banco do Brasil, Caixa, Itaú, etc. If the user enters the target domain, the Trojan will decrypt and load the internal spy module toReal-time monitoring of bank login actions, steal credentials or tamper with the login interface.
(3) The third stage: Maverick.Agent spy program
Maverick.Agent is responsible for collecting system information and executing instructions. It first confirms that the system is located in Brazil, checking the time zone, language, locale settings and date format to avoid running in a sandbox or foreign environment. Once it is determined that the conditions are met, the program will connect toadoblesecuryt[.]comThe C&C server transmits host name, operating system version, MAC address and other information.
Features at this stage include:
-
Keyboard skimming and screen capture
-
Manipulate application windows
-
Display fake system or bank security prompts
-
Create a full screen mask to lock user operations
Advanced fraud techniques: fake bank interface and interactive phishing
Water Saci’s attack behavior is not limited to background theft, but also imitates real bank websites through **full-screen overlay** to trick users into entering account passwords, electronic signatures or QR codes with extremely high fidelity. The malware uses Base64-encoded PNG images to reproduce real bank interfaces. Targeted institutions include:Banco do Brasil、Bradesco、Binance、Santanderwait. Some Java application windows were even forcibly renamed “Sicoobnet Empresarial” to disguise themselves as legitimate banking software.
WhatsApp hijacking and automated control
In another branch of payload, the malware specifically targets WhatsApp for hijacking. After confirming that the system language and regional settings match Brazil or the United States, it will download the relevant components and create Selenium and Chromedriver locally forAutomatically control the browser and log in to WhatsApp Web. By embedding the JavaScript module “wppconnect.js”, the program can automatically send messages and attachments to all contacts. Researchers confirmed that the content of these messages exactly matched the screenshots of malicious WhatsApp messages circulating on social media, confirming that the operation was actively operating in a real environment.
Trend Micro pointed out that the attacker deliberately asked the victim to “open a file on the computer”, displaying the target name andEnterprise usersLord. This means that the attacker is targetingBYOD (bring your own device) environment for employeesand communication application vulnerabilities. In modern enterprises, instant messaging tools such as WhatsApp and Telegram are often used informally for business contacts, which provides attackers with a way to bypass traditional email and network gateway protection. Although there has not yet been a disaster in Taiwan, because Taiwanese people are highly dependent on messaging software such as LINE and Messenger, it is very important to prevent the same type of viruses in advance.
Defense Advice and Strategies
Trend Micro makes three specific recommendations to help businesses and individuals reduce the risk of such attacks:
-
Disable automatic downloads
Turn off WhatsApp’s automatic media and file download settings to prevent users from inadvertently contacting malicious files. -
Restrict personal application file transfers
Block the file transfer function of personal messaging applications such as WhatsApp and Telegram through endpoint security policies or firewall settings. For enterprises that adopt BYOD, whitelisting and containerized management should be adopted. -
Strengthen employee safety awareness
Regularly organize phishing prevention and communication security education to remind employees to remain suspicious of attachments or links even if they come from familiar contacts and confirm their authenticity through official channels.
Source: KOCPC Chinese