Water Saci Hackers Use WhatsApp to Deploy Persistent SORVEPOTEL Malware

Trend Micro Research has identified a significant evolution in the Water Saci malware campaign, moving away from traditional .NET-based delivery methods to script-driven techniques and using WhatsApp as the primary infection vector. On 8 October 2025, researchers discovered file downloads from WhatsApp Web sessions that employ Visual Basic Script downloaders and PowerShell scripts to propagate the SORVEPOTEL malware.

The campaign automatically distributes malicious ZIP files named Orcamento-2025*.zip to all contacts and groups connected with compromised WhatsApp accounts, with the payload delivered via a deceptive “WhatsApp Automation v6.0” banner.

The attack chain includes an obfuscated Visual Basic Script downloader, a PowerShell script that hijacks WhatsApp Web sessions, harvests contact lists, and orchestrates automated distribution, and a C2 setup that uses both HTTP and IMAP email channels to retrieve operational parameters and commands. The operators also emulate legitimate software branding and employ a dual-channel C2 architecture to enhance resilience against takedowns.

According to Trend Micro Research, enterprises should tighten policies, educate employees on social engineering threats, and implement robust detection to mitigate these increasingly sophisticated campaign techniques.