InfoSecBulletin Cybersecurity for mankind
Trend™ Research is investigating a malware campaign that uses WhatsApp to infect users. This attack is focused on spreading quickly and taking advantage of social trust, rather than theft or ransomware. It’s called SORVEPOTEL and is currently most active in Brazil.
The campaign is dubbed SORVEPOTEL by Trend Micro that weaponizes the trust with the platform to extend its reach across Windows systems, adding the attack is “engineered for speed and propagation” rather than data theft or ransomware.
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
“SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments,” researchers Jeffrey Francis Bonaobra, Maristel Policarpio, Sophia Nilette Robles, Cj Arsley Mateo, Jacob Santos, and Paul John Bardon said.
“Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers.”
The malware spreads through the desktop version of WhatsApp once the attachment is opened, leading to the banning of infected accounts for spam. There’s no evidence that the attackers have used this access to steal data or encrypt files.
Most infections, 457 out of 477 cases, are in Brazil, primarily affecting government, public service, manufacturing, technology, education, and construction sectors.
The attack begins with a phishing message from a compromised WhatsApp contact, making it look credible. It includes a ZIP file that pretends to be a harmless receipt or health app.
Evidence suggests that the campaign operators have sent the ZIP files via email from legitimate-looking addresses.
If the recipient opens the attachment, they will inadvertently launch a Windows shortcut (LNK) file that executes a PowerShell script to download the main payload from an external server (e.g., sorvetenopoate[.]com).
The downloaded file is a batch script that copies itself to the Windows Startup folder for automatic launching at system start. It also executes a PowerShell command to contact a command-and-control (C2) server for more instructions or malicious components.
SORVEPOTEL mainly operates by using WhatsApp to spread. If the malware identifies active WhatsApp Web on an infected device, it sends a malicious ZIP file to all contacts and groups linked to the victim, enabling quick transmission.
“This automated spreading results in a high volume of spam messages and frequently leads to account suspensions or bans due to violations of WhatsApp’s terms of service,” Trend Micro said.
“The SORVEPOTEL campaign demonstrates how threat actors are increasingly leveraging popular communication platforms like WhatsApp to achieve rapid, large-scale malware propagation with minimal user interaction.”
