Fast Facts

• Malware campaign targets Brazilian users via WhatsApp Web, stealing financial data and contact lists.
• Attack uses automation tools to hijack sessions and spread through victims’ trusted contacts.
• Advanced phishing evades antivirus by running malicious code entirely in memory.
• Banking trojans monitor for over 20 major financial institutions and crypto platforms.
• Attackers exfiltrate stolen data to remote servers in real-time for campaign control.

Trust Exploited: A New Malware Playbook

Picture this: a friendly message appears in your WhatsApp chat, sent by a familiar contact. Attached is a file with a polite greeting - nothing suspicious, right? But behind the scenes, a silent predator is at work, exploiting the very trust that makes WhatsApp such a vital part of daily life in Brazil.

This isn’t the first time cybercriminals have hijacked popular platforms, but the latest campaign uncovered by K7 Labs marks a dangerous evolution. By blending open-source automation tools, clever obfuscation, and memory-resident malware, hackers have crafted a nearly invisible attack that turns WhatsApp Web into both a delivery system and a data siphon.

How the Attack Works: Automation, Deception, and Memory

The scheme begins with a classic phishing email containing a booby-trapped ZIP file. Inside lurks a script that, once clicked, downloads legitimate tools like Python and Selenium - usually harmless, but here weaponized to automate WhatsApp Web. The malware sidesteps antivirus by encoding its actions and keeping its payloads in memory, like a thief who leaves no footprints.

Most disturbingly, the malware doesn’t need your QR code to hijack your session. It rummages through your browser’s stored data - cookies, session tokens, and more - then launches WhatsApp Web as if it were you. With access secured, it injects malicious code to harvest your entire contact list, filtering out businesses and groups, and then sends out new phishing messages to your friends and family. Each message contains the infectious attachment, distributed entirely in memory so security tools remain blind.

Banking Trojans and a Brazilian Focus

But the heist doesn’t stop with social engineering. Parallel to spreading through WhatsApp, the malware installs a banking trojan primed to monitor for activity in over 20 Brazilian banks and major crypto exchanges like Binance and Coinbase. When a user opens a banking app or website, the trojan springs into action - slipping into memory, collecting credentials, and sending everything back to attacker-controlled servers via encrypted channels.

This campaign, dubbed Water-Saci, belongs to a long lineage of Brazilian banking malware. Similar attacks - like those involving the Grandoreiro and Mekotio trojans - have plagued South America for years, often exploiting social trust and local banking habits. What makes Water-Saci stand out is its seamless integration of WhatsApp automation and its uncanny ability to dodge disk-based detection, a trend noted by security analysts at Kaspersky and IBM X-Force in recent reports.

The Social Engineering Arms Race

Social engineering remains the hackers’ secret weapon. By leveraging real, trusted contacts, attackers dramatically increase their odds of tricking even cautious users. With WhatsApp’s dominance in Brazilian daily life, the social cost of a breach - lost trust, financial loss, and spread to loved ones - can be devastating. As Brazil continues to digitize its financial sector, the stakes will only climb.

WIKICROOK

• Phishing: Phishing is a cybercrime where attackers send fake messages to trick users into revealing sensitive data or clicking malicious links.
• Session Token: A session token is a unique digital code that keeps users logged in to websites or apps. If stolen, attackers can access accounts without a password.
• Memory: Memory is a computer’s temporary storage that holds active data and instructions. It’s a frequent target for cyberattacks seeking sensitive information.
• Automation Script: An automation script is a set of instructions that performs tasks automatically, like logging in or sending messages, without needing human input.
• Banking Trojan: A Banking Trojan is malware that targets financial data by stealing banking credentials and personal information, often by mimicking trusted apps.