Water Saci Evolves: Multi-Layered WhatsApp Worm Uses IMAP Email for Covert C2 and Session Hijacking

Researchers from Trend Research have identified a major evolution in the Water Saci malware campaign, which has progressed from WhatsApp distribution to a multi-layered, script-driven botnet capable of real-time coordination and remote control. The campaign, first observed in September 2025, now uses an email-based C&C infrastructure with IMAP to retrieve encrypted commands, and then switches to HTTP polling for follow-up instructions if the email channel is unavailable, according to Trend Micro.

The malware impersonates “WhatsApp Automation v6.0” to harvest all contacts from the victim’s WhatsApp Web session and distribute malicious ZIP files, with the PowerShell script hijacking WhatsApp Web sessions and enabling in-memory, fileless infection. The backdoor supports pausing, resuming, and monitoring, effectively turning infected machines into a botnet tool, and it uses ChromeDriver and Selenium to automate WhatsApp Web tasks, bypassing QR-code authentication.

Trend Research notes that Water Saci shares similarities with the Coyote banking trojan and has undergone three evolutionary waves, from ZIP-based phishing to browser-state abuse and script-based, in-memory loading. The report was published on 29 October 2025.