Overview

• The campaign relies on ZIP attachments or links that trigger Windows shortcut files and scripts to install the malware and establish persistence.
• Once on a PC with an active WhatsApp Web session, the malware automatically sends the malicious file to the victim’s contacts and groups, which can lead to account bans for spam.
• Trend Micro has logged 477 infections to date, 457 in Brazil, with indicators such as language and locale checks pointing to a Brazil-focused operation.
• Researchers say the malware can spy on browser activity and display fake banking interfaces, with configurations tied to major Brazilian banks and cryptocurrency platforms.
• Security guidance highlights disabling automatic media downloads, keeping systems updated, limiting file transfers on corporate machines, and logging out of WhatsApp Web when not in use, while WhatsApp issued general safety reminders.