WhatsApp Worm Targets Brazilian Banking Clients – Sophos Information

Counter Menace Unit™ (CTU) researchers are investigating a number of incidents in an ongoing marketing campaign concentrating on customers of the WhatsApp messaging platform. The marketing campaign, which began on September 29, 2025, is concentrated on Brazil and seeks to trick customers into executing a malicious file hooked up to a self-spreading message acquired from a beforehand contaminated WhatsApp net session. If executed, the worm makes an attempt to duplicate itself to the sufferer’s WhatsApp contacts and set up a banking trojan tailor-made for Brazilian banks and cryptocurrency exchanges.

In a single incident noticed by Sophos analysts, a person downloaded a ZIP archive by way of the web-based model of the WhatsApp messaging platform. Third-party reviews of comparable exercise reveal that the archive file was hooked up to a WhatsApp message originating from a recognized WhatsApp contact. The message said the content material might solely be seen on a pc (see Determine 1), a ploy to make sure the recipient opened the file on a desktop laptop versus a cellular machine. The archive contained a malicious Home windows LNK file that, when launched, initiated a sequence of malicious PowerShell instructions.

Determine 1. WhatsApp message despatched from an contaminated WhatsApp contact (left, supply: X.com), with translation (proper)

The goal area of the LNK file contained an obfuscated Home windows command that constructed and ran an preliminary Base64-encoded PowerShell command. The primary-stage PowerShell command covertly launched an Explorer course of that downloaded the next-stage PowerShell command from a distant command and management (C2) server hosted on hxxps://www.zapgrande[.]com (see Determine 2).

Determine 2. First-stage PowerShell command launches from malicious LNK file. (Supply: Sophos)

The downloaded second-stage PowerShell command tried to switch native safety controls. Feedback written in Portuguese within the PowerShell explicitly said the creator’s protection evasion targets: “add an exclusion in Microsoft Defender” and “disable UAC” (see Determine 3).

Determine 3. Second-stage PowerShell goals to disable safety defenses. (Supply: Sophos)

As of this publication, Sophos has detected first-stage PowerShell exercise in over 400 buyer environments on greater than 1,000 endpoints. The archive recordsdata observe a number of naming patterns, together with NEW-20251001_150505-XXX_XXXXXXX.zip, ORCAMENTO_XXXXXXX.zip, and COMPROVANTE_20251002_XXXXXXX.zip. ‘Orcamento’ and ‘Comprovante’ are Portuguese for ‘Funds’ and ‘Voucher’. Three distinctive C2 domains had been noticed, and an extra payload was recognized in 5 infections. This extra payload was the official Selenium browser automation instrument, which enabled management of working browser classes on the contaminated host.

Sophos evaluation of the Selenium circumstances is ongoing, however the preliminary levels of an infection and the presence of the Selenium payload align with third-party reporting that describes the identical marketing campaign delivering two doable payloads to contaminated endpoints: a Selenium occasion with an identical ChromeDriver, and a banking trojan named Maverick. Each payloads had been delivered by way of the identical C2 infrastructure and solely to hosts that handed a set of anti-analysis checks. The Maverick implant monitored energetic browser classes for connections to a goal record of URLs related to Brazilian banks and cryptocurrency exchanges. When visitors matched a goal monetary area, a subsequent feature-rich .NET banking trojan was put in.

Sophos researchers are additionally investigating doable hyperlinks between the continued marketing campaign and a sequence of prior reported campaigns that distributed a banking trojan named Coyote concentrating on customers within the Brazilian. Coyote was first reported in February 2024 and was distributed as a Home windows software updater constructed utilizing the Squirrel utility. In January 2025, risk actors used malicious LNK recordsdata to begin a multi-stage PowerShell an infection chain that contaminated hosts with Coyote payloads created with the Donut shellcode era instrument. A Might 2025 report tried to hyperlink prior Coyote malware campaigns with the Coyote banking trojan being distributed by way of WhatsApp Internet messages in January. Not one of the infections noticed by Sophos within the September marketing campaign resulted within the supply of a banking trojan payload, however the few Selenium circumstances probably resulted in WhatsApp net session hijacking and self-propagation (see Determine 4). Sophos researchers are working to independently decide whether or not Maverick is an evolution of Coyote.

Determine 4. An infection chain delivering Selenium payload. (Supply: Sophos)

CTU™ researchers suggest that organizations educate staff concerning the dangers of opening suspicious attachments despatched by way of social media and immediate messaging platforms, even when acquired from recognized contacts. Immediate response to detections of suspicious PowerShell execution can include infections in early levels of the kill chain.

The risk indicators in Desk 1 can be utilized to detect exercise associated to this risk. The domains could include malicious content material, so contemplate the dangers earlier than opening them in a browser.

Indicator	Sort	Context
expansiveuser . com	Area identify	C2 server utilized in WhatsApp worm marketing campaign
zapgrande . com	Area identify	C2 server utilized in WhatsApp worm marketing campaign
sorvetenopote . com	Area identify	C2 server utilized in WhatsApp worm marketing campaign

Desk 1. Indicators for this risk.

Sophos MDR (Managed Detection and Response) case creating detections referring to this risk are detailed in Desk 2.

Title	Description
WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1	Detects suspicious PowerShell course of with command line with begin of suspicious Base64 encoded instructions
WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1-SUSP-PARENT	Detects suspicious PowerShell course of with command line with begin of suspicious Base64 encoded instructions spawning from a suspicious dad or mum
WIN-PRI-EXE-SUSP-7ZIP-SUBPROCESS-1	Identifies suspicious processes spawning from 7zip, together with cmd.exe and powershell.exe, that would point out the tried exploitation of CVE-2022-29072