WhatsApp Worm Targets Brazilian Banking Prospects

Counter Risk Unit™ (CTU) researchers are investigating a number of incidents in an ongoing marketing campaign focusing on customers of the WhatsApp messaging platform. The marketing campaign, which began on September 29, 2025, is concentrated on Brazil and seeks to trick customers into executing a malicious file connected to a self-spreading message acquired from a beforehand contaminated WhatsApp net session. If executed, the worm makes an attempt to duplicate itself to the sufferer’s WhatsApp contacts and set up a banking trojan tailor-made for Brazilian banks and cryptocurrency exchanges.

In a single incident noticed by Sophos analysts, a consumer downloaded a ZIP archive through the web-based model of the WhatsApp messaging platform. Third-party experiences of comparable exercise reveal that the archive file was connected to a WhatsApp message originating from a recognized WhatsApp contact. The message acknowledged the content material might solely be considered on a pc (see Determine 1), a ploy to make sure the recipient opened the file on a desktop pc versus a cell system. The archive contained a malicious Home windows LNK file that, when launched, initiated a sequence of malicious PowerShell instructions.

Determine 1. WhatsApp message despatched from an contaminated WhatsApp contact (left, supply: X.com), with translation (proper)

The goal discipline of the LNK file contained an obfuscated Home windows command that constructed and ran an preliminary Base64-encoded PowerShell command. The primary-stage PowerShell command covertly launched an Explorer course of that downloaded the next-stage PowerShell command from a distant command and management (C2) server hosted on hxxps://www.zapgrande(.)com (see Determine 2).

Determine 2. First-stage PowerShell command launches from malicious LNK file. (Supply: Sophos)

The downloaded second-stage PowerShell command tried to change native safety controls. Feedback written in Portuguese within the PowerShell explicitly acknowledged the writer’s protection evasion targets: “add an exclusion in Microsoft Defender” and “disable UAC” (see Determine 3).

Determine 3. Second-stage PowerShell goals to disable safety defenses. (Supply: Sophos)

As of this publication, Sophos has detected first-stage PowerShell exercise in over 400 buyer environments on greater than 1,000 endpoints. The archive information comply with a number of naming patterns, together with NEW-20251001_150505-XXX_XXXXXXX.zip, ORCAMENTO_XXXXXXX.zip, and COMPROVANTE_20251002_XXXXXXX.zip. ‘Orcamento’ and ‘Comprovante’ are Portuguese for ‘Funds’ and ‘Voucher’. Three distinctive C2 domains have been noticed, and a further payload was recognized in 5 infections. This extra payload was the respectable Selenium browser automation device, which enabled management of working browser periods on the contaminated host.

Sophos evaluation of the Selenium circumstances is ongoing, however the preliminary levels of an infection and the presence of the Selenium payload align with third-party reporting that describes the identical marketing campaign delivering two attainable payloads to contaminated endpoints: a Selenium occasion with an identical ChromeDriver, and a banking trojan named Maverick. Each payloads have been delivered through the identical C2 infrastructure and solely to hosts that handed a set of anti-analysis checks. The Maverick implant monitored energetic browser periods for connections to a goal checklist of URLs related to Brazilian banks and cryptocurrency exchanges. When site visitors matched a goal monetary area, a subsequent feature-rich .NET banking trojan was put in.

Sophos researchers are additionally investigating attainable hyperlinks between the continuing marketing campaign and a sequence of prior reported campaigns that distributed a banking trojan named Coyote focusing on customers within the Brazilian. Coyote was first reported in February 2024 and was distributed as a Home windows software updater constructed utilizing the Squirrel utility. In January 2025, risk actors used malicious LNK information to start out a multi-stage PowerShell an infection chain that contaminated hosts with Coyote payloads created with the Donut shellcode era device. A Might 2025 report tried to hyperlink prior Coyote malware campaigns with the Coyote banking trojan being distributed through WhatsApp Internet messages in January. Not one of the infections noticed by Sophos within the September marketing campaign resulted within the supply of a banking trojan payload, however the few Selenium circumstances doubtless resulted in WhatsApp net session hijacking and self-propagation (see Determine 4). Sophos researchers are working to independently decide whether or not Maverick is an evolution of Coyote.

Determine 4. An infection chain delivering Selenium payload. (Supply: Sophos)

CTU™ researchers suggest that organizations educate workers concerning the dangers of opening suspicious attachments despatched through social media and instantaneous messaging platforms, even when acquired from recognized contacts. Immediate response to detections of suspicious PowerShell execution can comprise infections in early levels of the kill chain.

The risk indicators in Desk 1 can be utilized to detect exercise associated to this risk. The domains might comprise malicious content material, so think about the dangers earlier than opening them in a browser.

Indicator	Sort	Context
expansiveuser . com	Area title	C2 server utilized in WhatsApp worm marketing campaign
zapgrande . with	Area title	C2 server utilized in WhatsApp worm marketing campaign
ice creamnopot . with	Area title	C2 server utilized in WhatsApp worm marketing campaign

Desk 1. Indicators for this risk.

Sophos MDR (Managed Detection and Response) case creating detections referring to this risk are detailed in Desk 2.

Title	Description
WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1	Detects suspicious PowerShell course of with command line with begin of suspicious Base64 encoded instructions
WIN-EXE-PRC-POWERSHELL-WITH-BASE64-START-1-SUSP-PARENT	Detects suspicious PowerShell course of with command line with begin of suspicious Base64 encoded instructions spawning from a suspicious father or mother
WIN-PRI-EXE-SUSP-7ZIP-SUBPROCESS-1	Identifies suspicious processes spawning from 7zip, together with cmd.exe and powershell.exe, that would point out the tried exploitation of CVE-2022-29072