SORVEPOTEL

SORVEPOTEL is a malware delivery and propagation operation associated with the abuse of authenticated WhatsApp Web sessions to distribute malicious lures and stage follow-on malware. It has been linked with high confidence to a Python-based worm that automates browser activity through Selenium and ChromeDriver, hijacks or reuses active WhatsApp Web sessions, harvests contacts, and sends malicious messages at scale. In observed activity, SORVEPOTEL functioned as the delivery layer for a multi-stage intrusion chain that ultimately deployed the Latin American banking malware Astaroth, also known as Guildma. The operation’s tradecraft emphasizes stealth, automation, and trusted-channel abuse. Initial delivery relied on malicious script files sent through WhatsApp conversations, after which PowerShell and additional staged components were used to retrieve and execute further payloads. The infection chain incorporated obfuscated loaders, MSI-based staging, AutoIt components, and in-memory execution inside a hollowed system process. The workflow also demonstrated resilience through parallel execution paths, dynamic component retrieval, and extensive use of legitimate tools and living-off-the-land techniques. SORVEPOTEL’s observed capabilities include session hijacking, initial access through social engineering delivered over messaging platforms, automated propagation, defense evasion through obfuscation and in-memory execution, and post-exploitation support for downstream malware deployment. In the documented campaign, its activity directly enabled credential-focused and financially motivated malware operations against Brazilian banking and cryptocurrency users. SORVEPOTEL is best understood as a specialized delivery and worming component within a broader financially motivated cybercrime ecosystem rather than as a standalone ransomware or destructive actor.