Water Saci Campaign Uses LLMs to Convert Malware to Python, Spreads Banking Trojan Via WhatsApp Worm

A campaign known as “Water Saci” has pivoted its tactics, leveraging artificial intelligence and WhatsApp to target Brazilian users with a banking Trojan. A new report from Trend Micro reveals that the threat actors have likely used Large Language Models (LLMs) to rewrite their malware from PowerShell to Python, boosting compatibility and automation.

The infection chain remains complex, with delivery via WhatsApp messages that use stolen or trusted contacts to spread malicious content, and an MSI installer downloaded after an initial script execution. Once active, the malware can perform VNC mirroring, overlay fake login screens, and persist by modifying the Windows Registry, while scanning for keywords related to major Brazilian banks such as Bradesco, Itaú and Santander.

According to Trend Micro, the attackers have automated the propagation of malware through trusted channels like WhatsApp, creating a self-sustaining infection ecosystem. The report notes a shift toward AI-assisted development and a broader browser-compatible, object-oriented code structure to accelerate operations.