WhatsApp Exploited to Spread SORVEPOTEL Malware on Windows Systems

An aggressive malware campaign dubbed SORVEPOTEL is exploiting WhatsApp messages to infiltrate Windows systems, with its epicentre in Brazil, according to GBHackers. Trend Research telemetry shows that 457 of the 477 detected infections originate in Brazil, primarily within government and public service organisations but also affecting manufacturing, technology, education and construction sectors.

The attack begins when a user receives a phishing message on WhatsApp from a compromised contact, with Portuguese ZIP attachments that resemble legitimate documents, and in some cases alternate vectors via phishing emails delivering ZIPs.

Inside the ZIP resides a Windows shortcut that launches a hidden PowerShell or command-line script, which downloads the primary payload from attacker‑controlled domains and executes further components, using typo‑squatted URLs such as sorvetenopoate[.]com, expahnsiveuser[.]com and sorvetenopotel[.]com.

The downloaded payload copies itself into the Windows Startup folder to persist on boot, and then contacts C2 servers to retrieve additional in‑memory payloads, while automatically redistributing the same ZIP file to all contacts and groups in the victim’s WhatsApp, driving rapid exponential spread. Mitigations include disabling automatic execution of LNK files and reinforcing phishing defences, with Trend Micro continuing to track SORVEPOTEL closely.