Water Saci: Brazil’s WhatsApp-Borne Malware Storm

Summary

The Water Saci campaign is an aggressive, Brazil-focused malware operation that leverages WhatsApp to distribute the SORVEPOTEL malware targeting Windows users. First identified in 2025, the campaign primarily impacts financial institutions and cryptocurrency exchanges, weaponizing social engineering and automation to achieve mass propagation.

Victims receive malicious ZIP attachments through WhatsApp messages disguised as legitimate documents. Once opened, the malware executes PowerShell commands that download additional payloads directly into memory. These payloads enable in-memory execution, banking credential theft, and automated propagation, allowing SORVEPOTEL to hijack active WhatsApp Web sessions and send infected files to all contacts.

The campaign demonstrates a highly adaptive, multi-stage attack architecture combining reflective DLL loading, in-memory shellcode execution, and Selenium-based browser automation, making Water Saci one of the most sophisticated socially engineered malware outbreaks seen in Latin America.

Attack Details

Water Saci diverges from typical phishing and ransomware campaigns by exploiting WhatsApp’s communication trust model as its core infection vector. The operation centers around SORVEPOTEL, a self-propagating Windows malware engineered for speed and persistence rather than direct financial gain.

Attackers send deceptive messages in Portuguese containing ZIP files disguised as invoices or receipts. When victims extract and execute these files, malicious LNK shortcuts launch hidden PowerShell scripts that connect to remote servers, download additional components, and execute them entirely in memory using Base64 encoding and obfuscation.

Once established, SORVEPOTEL performs several key functions:

• Propagation: Automatically forwards malicious ZIPs to all WhatsApp contacts and groups.

• Persistence: Copies itself into the Windows Startup directory to relaunch after reboot.

• Stealth: Executes payloads via in-memory reflection and disables sandbox detection checks.

• Automation: Uses Selenium and Chromedriver to hijack WhatsApp Web sessions and autonomously send infected messages.

• Surveillance: Monitors browser activity, potentially enabling future modules for credential theft or ransomware deployment.

The malware’s architecture includes multiple stages — PowerShell loader → .NET DLL payload → encrypted shellcode → automation module — demonstrating a scalable, modular infection chain designed for continued adaptation. Its regional targeting logic ensures activation only within Brazilian locales, highlighting a geo-fenced, nation-specific cyber threat.

Recommendations

• Be Cautious with Unexpected WhatsApp Messages: Avoid opening ZIP attachments or clicking on links, even from known contacts, as compromised accounts are commonly exploited for distribution.

• Separate Work and Personal Communication: Avoid using personal messaging apps like WhatsApp for professional communication; enforce BYOD and messaging security policies.

• Keep Systems Updated: Regularly patch Windows OS, browsers, and security tools to minimize vulnerabilities exploited by PowerShell-based malware.

• Disable Auto-Downloads and Previews: Configure WhatsApp Web and browsers to block automatic media or file downloads to prevent drive-by infections.

• Enhance Endpoint Security: Deploy Next-Gen Antivirus (NGAV) and EDR tools leveraging behavioral detection and machine learning to identify PowerShell or in-memory threats.

Indicators of Compromise (IoCs)

SHA256 Hashes

• 2150f38c436eabebd3a93b3ace1064315153c882ce763991b6d0fb798766e0db

• bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328

• 2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6

• 3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b

• 1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500

• 441a2ad553d166df3cd0ea02482f4b8370e8f9618753e1937a251a6318cb8eba

• dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5

• c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5

URL

• hxxps[:]//sorvetenopote[.]com/api/itbi/Q77xivT4udoXayYELTwehMD666ovP6DZ

Domains

• expansiveuser[.]com

• imobiliariaricardoparanhos[.]com

• sorvetenopote[.]com

• zapgrande[.]com

• expahnsiveuser[.]com

• sorvetenopoate[.]com

• casadecampoamazonas[.]com

• bravexolutions[.]com

• adoblesecuryt[.]com

• saogeraldoshoping[.]com

IPv4 Addresses

• 23[.]227[.]203[.]179

• 140[.]99[.]164[.]81

• 92[.]246[.]130[.]15

MITRE ATT&CK TTPs

• TA0001 Initial Access – T1566, T1566.003 (Spearphishing via Service)

• TA0002 Execution – T1059, T1059.001 (PowerShell), T1204.001 (Malicious Link), T1204.002 (Malicious File)

• TA0003 Persistence – T1547, T1547.001 (Registry Run Keys / Startup Folder)

• TA0005 Defense Evasion – T1027 (Obfuscated Files), T1140 (Deobfuscate/Decode), T1036 (Masquerading)

• TA0007 Discovery – T1057 (Process Discovery), T1082 (System Information Discovery), T1614 (System Location Discovery)

• TA0009 Collection – T1113 (Screen Capture), T1056, T1056.001 (Keylogging)

• TA0010 Exfiltration – T1041 (Exfiltration Over C2 Channel)

• TA0011 Command and Control – T1071, T1071.001 (Web Protocols)

• TA0042 Resource Development – T1586 (Compromise Accounts)

References

• Trend Micro – Self-Propagating Malware Spreads via WhatsApp