Overview

• Researchers have logged 477 infections to date, with 457 in Brazil, and messages often urge victims to open files on a PC, pointing to a desktop and corporate focus.
• Malicious ZIPs sent over WhatsApp or email contain Windows shortcuts that launch scripts such as PowerShell to install persistent malware under attacker control.
• If a WhatsApp Web session is active, the malware auto‑forwards the same file to contacts and groups, which can trigger spam detection and account bans.
• The strain monitors browsing and aims to steal banking and crypto credentials, with major Brazilian institutions including Banco do Brasil, Itaú, Bradesco, Caixa and Santander cited as targets.
• WhatsApp advises opening files only from trusted senders, while Trend Micro recommends disabling automatic downloads, disconnecting WhatsApp Web when unused, keeping systems and antivirus updated, and tightening corporate file‑sharing policies.