Loading story…
The Water Saci malware campaign has evolved to leverage WhatsApp as its primary infection vector, distributing malicious ZIP files to contacts and groups from compromised accounts. The latest variant features a multi-layered worm that utilizes IMAP email protocols for covert command-and-control (C2) communications and session hijacking, enabling attackers to maintain persistent access and evade detection. The campaign incorporates advanced anti-analysis techniques and restricts activity to specific targets, making it more resilient and difficult to track.
Researchers have observed that the Water Saci malware now supports real-time remote management, allowing threat actors to orchestrate coordinated botnet operations, gather intelligence, and dynamically control infected endpoints. The campaign's multi-vector persistence mechanisms and sophisticated C2 infrastructure enable attackers to pause, resume, and monitor malware activity across multiple machines. Security vendors have released detection rules and threat intelligence to help organizations defend against this evolving threat.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
TrendAI reported a new Water Saci campaign in Brazil using WhatsApp-delivered ZIP, fake PDF, and especially HTA lures that launch obfuscated VBScript, download an MSI package, and deploy an AutoIt-based multi-stage banking trojan with persistence, anti-analysis, process hollowing, and extensive backdoor functions. The campaign also uses a Python propagation script, whatsz.py, described as an upgrade of the earlier PowerShell WhatsApp automation component.
Trend Micro assessed that Water Saci likely has ties to the Brazil-focused Coyote ecosystem based on overlapping tactics and the campaign's evolution, while noting that attribution remains unconfirmed.
Researchers reported that the campaign incorporated an email/IMAP-based channel to retrieve C2 URLs, followed by frequent HTTP polling for commands, along with registry and scheduled-task persistence. The updated malware also introduced real-time operator controls, anti-analysis checks, and telemetry-driven coordination across multiple infected hosts.
The Water Saci malware campaign was observed abusing hijacked WhatsApp Web sessions to send malicious ZIP files to victims' contacts and group chats, enabling worm-like propagation through trusted messaging relationships.
A newly observed October 2025 infection chain replaced earlier .NET-based components with an obfuscated VBS downloader and fileless PowerShell payloads executed in memory. The malware used a PowerShell component masquerading as 'WhatsApp Automation v6.0' to automate Chrome/Selenium, steal browser session data, and bypass WhatsApp Web authentication.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcesecurityonline.info
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat campaign known as Water Saci has escalated its attacks on Brazilian financial institutions and cryptocurrency exchanges by deploying a new Python-based malware variant. This campaign leverages artificial intelligence (AI) to convert previous PowerShell propagation scripts into Python, resulting in broader browser compatibility, improved error handling, and faster automation of malware delivery through WhatsApp Web. The attackers use a highly layered attack chain involving multiple file formats such as HTA files, ZIP archives, and PDFs to evade detection and complicate analysis, with the ultimate goal of stealing sensitive data and monitoring user activity on compromised machines. The campaign primarily targets enterprise users of WhatsApp in Brazil, exploiting social engineering tactics to deliver malicious payloads through convincing messages from trusted contacts. Researchers warn that the use of AI-driven code conversion and multi-format delivery methods marks a significant evolution in the threat landscape, making these attacks more sophisticated and harder to detect. While the campaign is currently concentrated in Brazil, there is concern it could expand to other Latin American countries as the techniques continue to evolve.
Jun 29, 2026
Researchers reported a Brazil-focused malware campaign that hijacks **WhatsApp Web** sessions to spread a malicious ZIP archive and deploy the **Eternidade Stealer** banking trojan. The infection chain uses an obfuscated **VBScript** downloader, an **MSI** dropper, an **AutoIt** loader, and a final **Delphi-based** payload, while a parallel Python-based worm installs **Selenium** and **ChromeDriver** to steal contacts and automatically send phishing messages to the victim’s WhatsApp contacts. The malware is heavily localized, checking for **Portuguese (Brazil)** language settings and focusing on Brazilian banks, fintech services, and cryptocurrency platforms. Once installed, the malware profiles the host, enumerates security products, monitors browser history and banking activity, and uses overlays and credential theft when targeted financial services are detected. Analysts said later stages are decrypted and loaded in memory, including reflective loading and **process hollowing** into `svchost.exe`, while command-and-control relies on attacker infrastructure including a PHP server, `013net.com.br`, and **IMAP over SSL** with hardcoded email credentials to retrieve updated infrastructure, with a fallback domain if that fails. The campaign, also tracked as a **Water-Saci/SorvePotel** variant and compared with older Brazilian banking trojans such as **Casbaneiro**, shows an evolving effort to combine messaging-platform worming with banking fraud and credential theft.
Aug 14, 2026
A new malware campaign, identified as SORVEPOTEL, has been actively targeting Windows users in Brazil by exploiting the WhatsApp messaging platform as its primary infection vector. The campaign is engineered for rapid propagation rather than data theft or ransomware, focusing on widespread distribution through social engineering tactics. Attackers initiate the infection by sending convincing phishing messages from already compromised WhatsApp accounts, which increases the credibility of the malicious communication. These messages contain ZIP file attachments that masquerade as legitimate documents, such as receipts or health app files, and are specifically crafted to require opening on a desktop, indicating a focus on enterprise environments. Upon opening the ZIP file, victims are prompted to execute a Windows shortcut (LNK) file, which silently triggers the malware installation on the system. Once installed, SORVEPOTEL leverages active WhatsApp Web sessions to automatically send the same malicious ZIP file to all contacts and groups associated with the victim’s account, enabling rapid self-propagation. This automated spamming behavior often results in the infected WhatsApp accounts being banned due to excessive activity. Trend Micro telemetry indicates that out of 477 detected cases, 457 occurred in Brazil, highlighting a strong regional focus. The campaign has notably impacted government and public service organizations, but has also affected entities in manufacturing, technology, education, and construction sectors. While the primary goal appears to be mass distribution, there is concern that similar techniques have previously been used in Brazil to target financial data, raising the risk of future campaigns with more damaging objectives. Researchers have also observed that, in addition to WhatsApp, the attackers may use email as a secondary distribution channel, sending the same malicious ZIP files from seemingly legitimate email addresses. The use of social trust and automation in this campaign demonstrates a sophisticated approach to maximizing infection rates. There is currently no evidence that SORVEPOTEL exfiltrates data or encrypts files, but the potential for further exploitation remains. The campaign underscores the importance of user awareness regarding phishing tactics, especially those leveraging trusted communication platforms. Security teams are advised to monitor for suspicious WhatsApp Web activity and educate users about the risks of opening unsolicited attachments. The incident highlights the evolving threat landscape where messaging platforms are increasingly abused for malware propagation, particularly in regions with high platform adoption.
Jun 29, 2026