New Banking Malware Exploits WhatsApp to Hijack Your Computer Remotely

Cybersecurity researchers have uncovered a sophisticated malware campaign targeting Brazilian users through WhatsApp, delivering a banking Trojan dubbed “Maverick.” The campaign has blocked over 62,000 infection attempts in Brazil during the first 10 days of October, illustrating its scale.

Victims receive a malicious ZIP file containing an LNK file via WhatsApp messages, often masquerading as legitimate bank documents with Portuguese-language filenames, and are told to view the file on a computer and bypass Chrome security warnings by selecting “keep file.” According to Securelist, Maverick uses self-propagating, worm-like behaviour via WPPConnect to hijack

victims’ WhatsApp accounts and automatically send the malicious files to contacts, enabling exponential spread, while the infection runs largely in memory with PowerShell scripts downloading encrypted payloads from command-and-control servers.

The campaign targets Brazilian time zone, language settings, regional configuration and date format, and employs multi-layer verification including User-Agent checks to prevent researchers obtaining samples; it uses modular components loaded through PowerShell, .NET, and Donut-encrypted shellcode, with AI reportedly used in certificate decryption routines and code structure.

Maverick monitors 26 Brazilian banking sites, six cryptocurrency exchanges and one payment platform, captures screenshots, logs keystrokes, controls the mouse, monitors browsing activity, terminates processes and overlays phishing pages to harvest credentials and enable remote control of infected machines. Benign-looking infrastructure aside, the malware’s collaboration with existing threats like Coyote suggests a refactoring or shared code libraries, marking a notable evolution in banking Trojan capabilities.