Self-Propagating Malware Spreading Via Whatsapp, Targets Brazilian Users
Trend Micro, October 3,2025
Trend Research has identified an active campaign spreading via WhatsApp through a ZIP file attachment. When executed, the malware establishes persistence and hijacks the compromised WhatsApp account to send copies of itself to the victim's contacts.
Key takeaways:
> SORVEPOTEL has been observed to spread across Windows systems with a message that requires users to open it on a desktop, suggesting that threat actors behind the campaign are targeting enterprises.
> The malware leverages active WhatsApp sessions to automatically distribute the same malicious ZIP file to all contacts and groups associated with the victim's compromised account for rapidly propagation.
> The payload of this threat is an infostealer designed to target various financial institutions and crypto exchanges in the Brazilian market.
Trend Research is currently investigating an aggressive malware campaign that leverages online instant messaging platform WhatsApp as its primary infection vector.