Maverick Fileless Trojan Turns Infected Phones into WhatsApp Worms to Steal Banking and UPI Credentials

On 17 October 2025, researchers from Kaspersky’s Global Research and Analysis Team (GReAT) detailed a massive fileless malware campaign targeting users in Brazil, distributing a banking Trojan named Maverick via WhatsApp messages. According to Kaspersky, the operation spreads through malicious ZIP files shared on WhatsApp containing a malicious LNK shortcut file, which launches a PowerShell script that connects to a command-and-control server to download the next stage.

The campaign relies on in-memory infection with PowerShell, .NET assemblies, and Donut shellcode, making it fully fileless and stealthy, while the C2 validates each request by checking the User-Agent string and responds with HTTP 401 for unauthorized connections.

Maverick self-propagates via WhatsApp Web using the WPPConnect project, turning infected users into distribution nodes, and it monitors 26 Brazilian banking websites, 6 cryptocurrency exchanges, and 1 payment platform to perform actions such as taking screenshots, keylogging, and injecting phishing overlays to steal credentials.

The malware authenticates with a unique password and uses SSL/TLS with custom X.509 certificates, decrypted with the password “Maverick2025!”, before executing commands like SCREENSHOT or GENERATEWINDOWREQUEST that trigger fake banking windows. Kaspersky notes a persistence mechanism that stores only a bootstrap .bat file in the Startup folder to keep the infection in memory, and telemetry shows the campaign blocked over 62,000 infection attempts in the first ten days of October 2025 in Brazil.