Water Saci Hackers Use WhatsApp to Deploy Persistent SORVEPOTEL Malware

Trend Micro Research has identified a significant evolution in the aggressive Water Saci malware campaign, revealing a new infection chain that abandons traditional .NET-based delivery methods in favor of sophisticated script-driven techniques.

On October 8, 2025, researchers discovered file downloads originating from WhatsApp Web sessions that utilize Visual Basic Script downloaders and PowerShell scripts to propagate the SORVEPOTEL malware, marking a dangerous shift in the threat actors’ operational capabilities.

The campaign continues to leverage WhatsApp as its primary infection vector, with the malware automatically distributing malicious ZIP files named “Orcamento-2025*.zip” to all contacts and groups associated with compromised accounts.

This evolution demonstrates the attackers’ commitment to maintaining evasion effectiveness while scaling their propagation operations across Brazil’s highly connected messaging platform ecosystem.

The new attack chain begins when users download and extract the suspicious ZIP archive, which contains an obfuscated Visual Basic Script downloader.

This downloader issues a PowerShell command that executes fileless payloads directly in system memory using the New-Object Net.WebClient method.

The downloaded PowerShell script, internally named “whatsapp_automation_v6_robust.ps1,” handles the sophisticated work of hijacking WhatsApp Web sessions, harvesting contact lists, and orchestrating the automated distribution campaign.

Upon execution, the malware displays a deceptive banner claiming to be “WhatsApp Automation v6.0,” masking its malicious nature behind seemingly legitimate software branding.

A temporary workspace in C:\temp, downloads the latest WhatsApp automation library (WA-JS) from GitHub, and retrieves a malicious ZIP payload.

The consistent use of Portuguese language throughout the attack chain suggests the threat actors specifically target Brazilian victims.

The script immediately establishes contact with command-and-control infrastructure at hxxps://miportuarios[.]com/sisti/config[.]php to download operational parameters including target lists, message templates, and timing configurations.

Sophisticated Browser Hijacking Mechanism

The malware demonstrates advanced technical capabilities by checking the installed Chrome version and downloading the appropriate ChromeDriver for browser automation.

It then installs the Selenium PowerShell module to enable automated browser control. After terminating existing Chrome processes and clearing old sessions, the malware copies the victim’s legitimate Chrome profile data—including cookies, authentication tokens, and saved browser sessions—to its temporary workspace.

Before establishing persistence, the malware implements a WMI-based mutex mechanism to prevent multiple instances from running simultaneously. 

This technique allows the malware to bypass WhatsApp Web’s authentication entirely, gaining immediate access without triggering security alerts or requiring QR code scanning.

With hijacked sessions established, the malware launches Chrome with specific automation flags designed to evade detection and injects the WA-JS library for complete WhatsApp control.

It systematically harvests WhatsApp contacts using sophisticated JavaScript filtering and immediately exfiltrates the contact lists to the command-and-control server for campaign coordination.

Multi-Channel Command and Control

The most sophisticated aspect of the backdoor involves its dual-channel communication architecture. Rather than relying solely on HTTP-based communication, the malware leverages IMAP connections to terra.com.br email accounts using hardcoded credentials.

Besides the email stated in it was also observed that the attackers used other emails with different domains and passwords. 

This email-based infrastructure retrieves command-and-control server URLs, providing attackers with a resilient fallback communication channel that complicates detection and disruption efforts.

The malware implements an advanced remote control system that allows attackers to pause, resume, and monitor spreading campaigns in real-time.

Before every contact and during message delays, the malware sends GET requests checking for operational status, receiving JSON responses that determine whether to continue or suspend distribution activities.

This sophisticated botnet-like capability transforms infected endpoints into a coordinated network capable of synchronized operations.

The evolution from .NET-based payloads to script-driven delivery mechanisms reflects the threat actors’ adaptability and increasing sophistication.

Trend Micro emphasizes that enterprises should review their security policies, educate employees about social engineering threats, and implement robust detection capabilities to mitigate these evolving banking Trojan campaigns that exploit Brazil’s widespread messaging platform adoption.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.