New Malware SORVEPOTEL Exploits WhatsApp, Threatens Global Organizations
A new malware threat, dubbed SORVEPOTEL, has been targeting organizations worldwide since early September 2025. The malware exploits messaging platforms, specifically WhatsApp, for its aggressive spread and has been observed targeting Brazilian organizations initially.
SORVEPOTEL gains entry through deceptive phishing messages, often disguised as innocent documents in ZIP attachments. Once executed, it establishes a foothold on the system by launching a hidden PowerShell script via a Windows shortcut (.LNK) file. This script downloads and runs the primary payload. The malware then copies itself into the Windows Startup folder for persistence and connects to command-and-control (C2) servers. It scans for active WhatsApp Web sessions and automatically propagates the same malicious ZIP across all contacts and groups, exploiting the messaging platform for replication. Additionally, it uses phishing emails as an alternative infection vector, with similarly named ZIP attachments appearing to originate from trusted institutions.
Enterprises worldwide are facing an aggressive campaign with SORVEPOTEL, which elevates itself into a significant threat due to its ability to exploit messaging platforms used for internal communication.
SORVEPOTEL, first observed targeting Brazilian organizations, has escalated into a global threat. It exploits messaging platforms, particularly WhatsApp, for rapid replication. To mitigate this threat, enterprises should ensure their systems are up-to-date, use active antivirus protection, raise user awareness about phishing, and implement robust network security measures. For specific information, consult reliable security reports and updates from renowned IT security companies or government bodies.
Read also:
- Sonatype Streamlines Cross-Platform App Installations with Docker and Chef
- Berlin Brandenburg Airport Struggles After Cyberattack Disrupts IT Systems
- Expanded Criticism of Human Rights Protections - Specialists Criticize Russia's Intensified Crackdown on Virtual Private Networks and Encrypted Applications
- Cyber Attack Nets $14 Million from WOO X Across Four Different Blockchains
