AI-Enhanced Python Malware Targets Brazilian Financial Institutions via WhatsApp

A threat campaign known as Water Saci has escalated its attacks on Brazilian financial institutions and cryptocurrency exchanges by deploying a new Python-based malware variant. This campaign leverages artificial intelligence (AI) to convert previous PowerShell propagation scripts into Python, resulting in broader browser compatibility, improved error handling, and faster automation of malware delivery through WhatsApp Web. The attackers use a highly layered attack chain involving multiple file formats such as HTA files, ZIP archives, and PDFs to evade detection and complicate analysis, with the ultimate goal of stealing sensitive data and monitoring user activity on compromised machines.

The campaign primarily targets enterprise users of WhatsApp in Brazil, exploiting social engineering tactics to deliver malicious payloads through convincing messages from trusted contacts. Researchers warn that the use of AI-driven code conversion and multi-format delivery methods marks a significant evolution in the threat landscape, making these attacks more sophisticated and harder to detect. While the campaign is currently concentrated in Brazil, there is concern it could expand to other Latin American countries as the techniques continue to evolve.