InfoSecBulletin Cybersecurity for mankind
Trend™ Research is investigating a malware campaign that uses WhatsApp to infect users. This attack is focused on spreading quickly and taking advantage of social trust, rather than theft or ransomware. It’s called SORVEPOTEL and is currently most active in Brazil.
The campaign is dubbed SORVEPOTEL by Trend Micro that weaponizes the trust with the platform to extend its reach across Windows systems, adding the attack is “engineered for speed and propagation” rather than data theft or ransomware.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments,” researchers Jeffrey Francis Bonaobra, Maristel Policarpio, Sophia Nilette Robles, Cj Arsley Mateo, Jacob Santos, and Paul John Bardon said.
“Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers.”
The malware spreads through the desktop version of WhatsApp once the attachment is opened, leading to the banning of infected accounts for spam. There’s no evidence that the attackers have used this access to steal data or encrypt files.
Most infections, 457 out of 477 cases, are in Brazil, primarily affecting government, public service, manufacturing, technology, education, and construction sectors.
The attack begins with a phishing message from a compromised WhatsApp contact, making it look credible. It includes a ZIP file that pretends to be a harmless receipt or health app.
Evidence suggests that the campaign operators have sent the ZIP files via email from legitimate-looking addresses.
If the recipient opens the attachment, they will inadvertently launch a Windows shortcut (LNK) file that executes a PowerShell script to download the main payload from an external server (e.g., sorvetenopoate[.]com).
The downloaded file is a batch script that copies itself to the Windows Startup folder for automatic launching at system start. It also executes a PowerShell command to contact a command-and-control (C2) server for more instructions or malicious components.
SORVEPOTEL mainly operates by using WhatsApp to spread. If the malware identifies active WhatsApp Web on an infected device, it sends a malicious ZIP file to all contacts and groups linked to the victim, enabling quick transmission.
“This automated spreading results in a high volume of spam messages and frequently leads to account suspensions or bans due to violations of WhatsApp’s terms of service,” Trend Micro said.
“The SORVEPOTEL campaign demonstrates how threat actors are increasingly leveraging popular communication platforms like WhatsApp to achieve rapid, large-scale malware propagation with minimal user interaction.”
