Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution

Maverick is a new banking Trojan detected in Brazil that spreads via WhatsApp by delivering a malicious ZIP containing an LNK file. Once activated, the infection chain is fully fileless, loading a .NET payload in memory and using Donut to decrypt and run subsequent stages, including a WhatsApp infector downloader that hijacks the victim’s WhatsApp account to mass-send the malicious message to contacts.

The campaign targets Brazilians, with the malware checking time zone, language, region and date format to ensure Brazil, otherwise it will not install. After infection, Maverick monitors access to 26 Brazilian bank websites, six cryptocurrency exchanges and one payment platform, and it can capture screenshots, log keystrokes, block banking pages, and inject phishing overlays.

The C2 communication uses the WatsonTCP library over SSL to casadecampoamazonas[.]com on port 443, with a specific initial password and API key validation to authenticate, while the final payload includes a component called Maverick[.]Agent that performs most banking-operations. According to Kaspersky, the campaigns blocked about 62 thousand infection attempts in the first 10 days of October, all in Brazil.