WhatsApp Worm Targets Users with Banking Malware, Steals Login Information

Cybersecurity researchers have uncovered a self-propagating WhatsApp worm campaign targeting users in Brazil with malware designed to steal banking credentials and cryptocurrency exchange login information.

The attack was first detected on 29 September 2025 and spreads via messages from infected WhatsApp contacts containing ZIP archives that use names such as “NEW-20251001_150505-XXX_XXXXXXX.zip” or Portuguese terms like ORCAMENTO and COMPROVANTE, luring victims to view content on a computer rather than a mobile device.

The ZIPs launch a multi-stage PowerShell infection chain from a malicious LNK file, with second-stage commands aiming to disable security protections by adding an exclusion in Microsoft Defender and by disabling UAC, before deploying either a Selenium browser automation payload for session hijacking or a banking trojan called Maverick to harvest credentials. According to Sophos, the attack can monitor for Brazilian bank connections and cryptocurrency exchange sites, delivering a feature-rich .NET banking trojan.

The campaign also exhibits self-propagation, attempting to spread to a victim’s WhatsApp contacts, amplifying its reach through social trust. Countermeasures emphasise user education about suspicious attachments and rapid response to PowerShell alerts, alongside keeping endpoint security up to date.