WhatsApp Worm: New SORVEPOTEL Malware Hijacks Sessions to Spread Aggressively Across Brazil

According to Trend Micro, the campaign, dubbed “Water Saci,” weaponises WhatsApp to launch one of the most aggressive self-propagating malware outbreaks seen in recent months, with the newly identified SORVEPOTEL designed to spread rapidly across Windows systems and target Brazilian financial institutions and cryptocurrency exchanges.

The infection begins with a phishing message from a compromised WhatsApp account that invites users to open a malicious ZIP file, which reveals a Windows shortcut (.LNK) that silently runs a PowerShell script. This script downloads and executes payloads from attacker-controlled domains such as sorvetenopotel[.]com and expahnsiveuser[.]com, and SORVEPOTEL can hijack active WhatsApp Web sessions to automatically distribute the same ZIP file to all contacts and groups.

Trend Micro notes that the malware specifically targets Brazilian banking customers, with institutions including Banco do Brasil, Bradesco, Itaú, Santander, and Caixa Econômica Federal among the targets, and it injects into sessions when users visit financial sites or exchanges like Binance and Mercado Bitcoin. The campaign has predominantly affected Brazil, and its bootstrapping includes anti-analysis measures and topmost full-screen overlays to capture credentials.