Tag: water saci

3 Attack Reports | 0 Vulnerabilities

Attack reports

Brazilian Campaign: Spreading the Malware via WhatsApp

A massive phishing campaign targeting Brazil is spreading malware through WhatsApp Web using an open-source automation script and loading a banking trojan into memory. The attack begins with a phishing email containing a malicious VBS script that downloads and executes an MSI file and another VBS f…
phishing
whatsapp
autoit
banking trojan
brazil
in-memory execution
selenium
sorvepotel
2025-11-24
water-saci
Published: November 24, 2025
Downloadable IOCs: 5

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | Trend Micro (US)

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more…
malware
loader
phishing
whatsapp
powershell
persistence
brazil
c server
lnk file
telegram
format
2025-10-06
whatsapp web
water saci
bradesco
brazilian
turn
watsonclient
sorvepotel
Published: October 6, 2025
Downloadable IOCs: 23

Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more…
malware
loader
phishing
whatsapp
powershell
persistence
brazil
c server
lnk file
telegram
format
2025-10-06
whatsapp web
water saci
bradesco
brazilian
turn
watsonclient
sorvepotel
Published: October 6, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports