Researchers Warn of Self-Spreading WhatsApp Malware Named SORVEPOTEL

Brazilian users are the focus of a new self-propagating WhatsApp malware campaign codenamed SORVEPOTEL, according to Trend Micro. The researchers describe an automated spread mechanism that relies on convincing phishing messages with malicious ZIP file attachments, which must be opened on a desktop to trigger the attack. Once executed, the malware propagates via the desktop web version of WhatsApp, causing infected accounts to be banned for sending excessive spam.

The campaign’s infections are heavily concentrated in Brazil, with 457 of 477 cases reported there and impacts across government, public service, manufacturing, technology, education and construction sectors.

The initial lure is a phishing message from an already compromised contact, with ZIP files sometimes distributed via legitimate-looking emails, and the payload includes a Windows startup persistence component and a PowerShell-based retrieval of further instructions from a remote server, all without evidence of data exfiltration or file encryption.

According to Trend Micro, the campaign demonstrates how threat actors are exploiting popular platforms like WhatsApp to enable rapid, large-scale malware propagation with minimal user interaction.