WhatsApp Malware 'Maverick' Hijacks Browser Sessions to Target Brazil's Biggest Banks

According to CyberProof, threat hunters have found similarities between the banking malware known as Coyote and a newly disclosed program called Maverick, which has been propagated via WhatsApp and targets Brazilian users and banks with decryption and credential theft capabilities.

Maverick, first documented by Trend Micro early last month and attributed to a threat actor named Water Saci, shares code overlaps with Coyote and can spread through WhatsApp Web using a self-propagating component called SORVEPOTEL delivered in a ZIP archive. The infection chain relies on a ZIP file that, when opened, downloads the first-stage payload and uses PowerShell to fetch a loader that disables Defender Antivirus and UAC before loading Maverick and SORVEPOTEL.

Once installed, Maverick checks the victim’s location by time zone, language, region, and date/time format and only proceeds if the user is in Brazil, subsequently targeting a hard-coded list of Latin American banking URLs and contacting a remote C2 for commands to harvest system information and host phishing pages. The campaign is spread through WhatsApp Web by hijacking active browser sessions, and the overall reach is underscored by Brazil’s large WhatsApp user base, with over 148 million active users.