WhatsApp Worm Targets Brazilian Banking Prospects – Sophos Information

Counter Risk Unit™ (CTU) researchers are investigating a number of incidents in an ongoing marketing campaign concentrating on customers of the WhatsApp messaging platform. The marketing campaign, which began on September 29, 2025, is targeted on Brazil and seeks to trick customers into executing a malicious file connected to a self-spreading message acquired from a beforehand contaminated WhatsApp internet session. If executed, the worm makes an attempt to duplicate itself to the sufferer’s WhatsApp contacts and set up a banking trojan tailor-made for Brazilian banks and cryptocurrency exchanges.

In a single incident noticed by Sophos analysts, a consumer downloaded a ZIP archive by way of the web-based model of the WhatsApp messaging platform. Third-party reviews of comparable exercise reveal that the archive file was connected to a WhatsApp message originating from a recognized WhatsApp contact. The message acknowledged the content material might solely be seen on a pc (see Determine 1), a ploy to make sure the recipient opened the file on a desktop laptop versus a cell machine. The archive contained a malicious Home windows LNK file that, when launched, initiated a sequence of malicious PowerShell instructions.

Determine 1. WhatsApp message despatched from an contaminated WhatsApp contact (left, supply: X.com), with translation (proper)

The goal subject of the LNK file contained an obfuscated Home windows command that constructed and ran an preliminary Base64-encoded PowerShell command. The primary-stage PowerShell command covertly launched an Explorer course of that downloaded the next-stage PowerShell command from a distant command and management (C2) server hosted on hxxps://www.zapgrande[.]com (see Determine 2).

Determine 2. First-stage PowerShell command launches from malicious LNK file. (Supply: Sophos)

The downloaded second-stage PowerShell command tried to switch native safety controls. Feedback written in Portuguese within the PowerShell explicitly acknowledged the creator’s protection evasion objectives: “add an exclusion in Microsoft Defender” and “disable UAC” (see Determine 3).

Determine 3. Second-stage PowerShell goals to disable safety defenses. (Supply: Sophos)

As of this publication, Sophos has detected first-stage PowerShell exercise in over 400 buyer environments on greater than 1,000 endpoints. The archive recordsdata comply with a number of naming patterns, together with NEW-20251001_150505-XXX_XXXXXXX.zip, ORCAMENTO_XXXXXXX.zip, and COMPROVANTE_20251002_XXXXXXX.zip. ‘Orcamento’ and ‘Comprovante’ are Portuguese for ‘Price range’ and ‘Voucher’. Three distinctive C2 domains had been noticed, and a further payload was recognized in 5 infections. This extra payload was the professional Selenium browser automation instrument, which enabled management of working browser classes on the contaminated host.

Sophos evaluation of the Selenium circumstances is ongoing, however the preliminary levels of an infection and the presence of the Selenium payload align with third-party reporting that describes the identical marketing campaign delivering two attainable payloads to contaminated endpoints: a Selenium occasion with an identical ChromeDriver, and a banking trojan named Maverick. Each payloads had been delivered by way of the identical C2 infrastructure and solely to hosts that handed a set of anti-analysis checks. The Maverick implant monitored energetic browser classes for connections to a goal checklist of URLs related to Brazilian banks and cryptocurrency exchanges. When visitors matched a goal monetary area, a subsequent feature-rich .NET banking trojan was put in.

Sophos researchers are additionally investigating attainable hyperlinks between the continuing marketing campaign and a sequence of prior reported campaigns that distributed a banking trojan named Coyote concentrating on customers within the Brazilian. Coyote was first reported in February 2024 and was distributed as a Home windows software updater constructed utilizing the Squirrel utility. In January 2025, risk actors used malicious LNK recordsdata to start out a multi-stage PowerShell an infection chain that contaminated hosts with Coyote payloads created with the Donut shellcode era instrument. A Could 2025 report tried to hyperlink prior Coyote malware campaigns with the Coyote banking trojan being distributed by way of WhatsApp Internet messages in January. Not one of the infections noticed by Sophos within the September marketing campaign resulted within the supply of a banking trojan payload, however the few Selenium circumstances doubtless resulted in WhatsApp internet session hijacking and self-propagation (see Determine 4). Sophos researchers are working to independently decide whether or not Maverick is an evolution of Coyote.

Determine 4. An infection chain delivering Selenium payload. (Supply: Sophos)

CTU™ researchers advocate that organizations educate workers concerning the dangers of opening suspicious attachments despatched by way of social media and on the spot messaging platforms, even when acquired from recognized contacts. Immediate response to detections of suspicious PowerShell execution can include infections in early levels of the kill chain.

The risk indicators in Desk 1 can be utilized to detect exercise associated to this risk. The domains could include malicious content material, so think about the dangers earlier than opening them in a browser.

Indicator	Kind	Context
expansiveuser . com	Area title	C2 server utilized in WhatsApp worm marketing campaign
zapgrande . com	Area title	C2 server utilized in WhatsApp worm marketing campaign
sorvetenopote . com	Area title	C2 server utilized in WhatsApp worm marketing campaign

Desk 1. Indicators for this risk.

Sophos MDR (Managed Detection and Response) case creating detections referring to this risk are detailed in Desk 2.

Title	Description
WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1	Detects suspicious PowerShell course of with command line with begin of suspicious Base64 encoded instructions
WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1-SUSP-PARENT	Detects suspicious PowerShell course of with command line with begin of suspicious Base64 encoded instructions spawning from a suspicious mother or father
WIN-PRI-EXE-SUSP-7ZIP-SUBPROCESS-1	Identifies suspicious processes spawning from 7zip, together with cmd.exe and powershell.exe, that would point out the tried exploitation of CVE-2022-29072