Water Saci

Water Saci is a Brazilian-focused malware campaign associated with banking-trojan activity and WhatsApp-based self-propagation. The operation has evolved from simpler phishing-style delivery into layered social-engineering chains that abuse trusted messaging relationships, especially through WhatsApp, to distribute malicious archives, script-based launchers, and MSI installers. Reporting links the campaign to a Python-based WhatsApp worm used to harvest contacts, send personalized lure messages, and forward malicious attachments to additional victims, enabling worm-like spread across user contact networks.

The campaign targets Windows systems and is heavily localized for Brazilian victims, including checks for Brazilian Portuguese environments and monitoring for Brazilian banks, payment services, fintech platforms, and cryptocurrency exchanges and wallets. Observed payload chains include script and installer stages that deploy Delphi-based banker or stealer components, perform host profiling, enumerate security products, and use anti-analysis and evasion measures. Documented functionality includes credential theft through banking overlays, active-window monitoring, contact theft, exfiltration of host and victim data, persistence, and process injection or hollowing into legitimate processes. Some reporting also notes dynamic command-and-control retrieval via IMAP and continued malware development across 2025.

Water Saci is notable for incorporating AI-assisted code conversion, with operators reportedly using large language models to help migrate earlier PowerShell propagation logic to Python, improving automation, compatibility, and operational flexibility. The campaign is primarily aimed at Brazilian financial institutions and cryptocurrency users, with potential spillover risk to other Latin American targets.