Maverick
Maverick is a Brazilian banking trojan first reported in 2024 and primarily targeting Windows users in Brazil. It is distributed through WhatsApp-centric worm activity, notably via the SORVEPOTEL spreader and hijacked WhatsApp Web sessions, with observed delivery through ZIP archives containing malicious LNK files that trigger multi-stage, largely fileless PowerShell and .NET infection chains. Multiple reports describe Maverick as using social engineering, WhatsApp abuse, and fileless execution, and as sharing significant code and technique overlap with the Brazilian banking trojan Coyote; some researchers assess it as a distinct new threat, while later reporting assesses TCLBANKER as a major evolution/update of the Maverick/SORVEPOTEL family. Trend Micro-linked reporting associates Maverick activity with the Water Saci cluster.
Its core functionality is credential theft and banking fraud against Brazilian financial institutions. Reported capabilities include monitoring browser sessions and active tab titles/URLs for targeted Brazilian banks, cryptocurrency exchanges, and at least one payment platform; opening phishing overlays; keylogging; screenshot capture; mouse control; process termination; screen blocking during banking access; and broader remote-command functionality through a .NET agent. One report states Maverick monitored 26 Brazilian bank websites, six cryptocurrency exchanges, and one payment platform. It specializes in browser monitoring, overlay phishing, keylogging, and screenshots to steal credentials and enable fraudulent transactions on desktop banking platforms.
Maverick includes a WhatsApp propagation component that abuses authenticated WhatsApp Web sessions, using Selenium and the open-source WPPConnect project to automate message sending to victims’ contacts in a worm-like manner. Campaign reporting describes self-spreading WhatsApp messages sent from previously infected sessions, often using Portuguese-language lures and archive attachments. The malware geofences victims and self-terminates or refuses installation outside Brazil, with checks including timezone, language/locale, region, and date format.
Observed infrastructure and indicators directly tied to Maverick reporting include sorvetenopote[.]com, casadecampoamazonas[.]com, expansiveuser[.]com, and zapgrande[.]com. Reported detections include HEUR:Trojan.Multi.Powenot.a and HEUR:Trojan-Banker.MSIL.Maverick.gen. Kaspersky reported blocking about 62,000 Maverick infection attempts in Brazil in the first 10 days of October in one observed campaign.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware family is assessed to be a major update of the Maverick, which is known to leverage a worm called SORVEPOTEL to spread via WhatsApp Web to a victim's contacts.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
This threat group employs a wider-ranging attack model focused on a bespoke delivery and propagation mechanism that includes WhatsApp, ClickFix techniques, and email-centric phishing.
The target field of the LNK file contained an obfuscated Windows command that constructed and ran an initial Base64-encoded PowerShell command.
The archive contained a malicious Windows LNK file that, when launched, initiated a series of malicious PowerShell commands. | The campaign ... seeks to trick users into executing a malicious file attached to a self-spreading message received from a previously infected WhatsApp web session.
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
The target field of the LNK file contained an obfuscated Windows command that constructed and ran an initial Base64-encoded PowerShell command.
Other notable actors included Coyote and emerging families like Maverick, which abused WhatsApp for distribution while maintaining fileless techniques and overlaps with established Brazilian banking malware to steal credentials and enable fraudulent transactions on desktop banking platforms.
Discovery
1 technique
Discovery
Collection
1 technique
Collection
Command and Control
2 techniques
Command and Control
Other
2 techniques
Other
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Older malware family referenced as a predecessor or related family to TCLBANKER.
Brazilian banking trojan family assessed as the predecessor or basis for TCLBANKER. It is known to use the SORVEPOTEL worm for propagation via WhatsApp Web.
Previously known LATAM/Brazilian banking trojan family assessed in the report as the predecessor or earlier family from which TCLBANKER is a major update.
Emerging Brazilian banking malware distributed via WhatsApp, using fileless techniques to steal credentials and facilitate fraudulent transactions on desktop banking platforms.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.