Fast Facts

• Water Saci hackers are using AI to convert malware from PowerShell to Python, making attacks faster and harder to detect.
• The campaign targets Brazilian WhatsApp Web users with malicious files disguised as harmless attachments.
• Attackers leverage automation tools to spread banking trojans, aiming to steal credentials from banks and crypto exchanges.
• The malware chain uses advanced evasion, including obfuscated scripts, browser automation, and multi-language targeting.
• Security experts urge layered defenses and user awareness as AI accelerates cybercriminal innovation.

From Scripts to Sophistication: A New Breed of Cyberattack

Imagine opening a WhatsApp message on your computer-a PDF, a ZIP file, or a simple-looking web file. In the blink of an eye, invisible code slips into your system, quietly setting the stage for digital theft. This is not tomorrow’s threat; it’s happening now in Brazil, courtesy of the Water Saci group.

Once known for using PowerShell (a common scripting tool), these hackers have leveled up. By tapping into artificial intelligence-specifically, large language models-they’ve transformed their malware into Python, a more adaptable and powerful programming language. This shift isn’t just cosmetic: Python lets them target multiple browsers, automate attacks, and work around security systems with alarming ease.

How the Attack Works: Malware’s New AI-Driven Engine

The Water Saci campaign starts with WhatsApp Web users receiving seemingly innocent files. Hidden inside, layers of tricky code-obfuscated Visual Basic scripts-evade security scans. As soon as a victim opens one of these files, the script contacts remote servers, downloads further malware installers, and launches a banking trojan.

The real innovation? The attackers used AI code-conversion tools to rework their old PowerShell scripts into modern Python. The new Python malware (dubbed whatsz.py) comes with helpful notes like “send message to multiple contacts at same time – super fast!”-the kind of optimization likely suggested by an AI assistant. This lets the malware rapidly spread itself through WhatsApp contacts, using browser automation tools like Selenium to send files and messages en masse.

Similar attacks have been seen before-think of Emotet’s email worming or Brazil’s own “Javali” banking trojan-but the Water Saci group’s use of AI marks a leap forward. Security researchers, including Kaspersky and ESET, have raised alarms about how automation and AI are lowering the bar for complex cybercrime.

Banking Trojans and the Brazilian Battleground

Once inside, the trojan spies on banking apps, sifts through browser histories, and waits for any sign of financial activity. When a user logs into a bank or crypto exchange, the malware injects fake login screens to steal credentials. It’s persistent, too-using advanced tricks like process hollowing to keep running even if discovered.

Brazil has long been a hotbed for banking malware, partly due to its large online population and financial sector. Water Saci’s campaign shows how AI is now turbocharging these threats, making attacks more scalable and harder to stop. The risks go beyond Brazil’s borders if these tactics spread or are sold to other cybercriminals on the dark web.

Staying Ahead of the Curve

With AI in their arsenal, cybercriminals are moving faster than ever. The Water Saci campaign is a wake-up call: as attackers innovate, defenders must do the same. Security experts recommend disabling auto-downloads in messaging apps, using advanced antivirus tools, and, most importantly, staying alert to unexpected files-even from trusted contacts.

The digital battleground is shifting, and the next move may be only a click away.

WIKICROOK

• Obfuscation: Obfuscation is the practice of disguising code or data to make it difficult for humans or security tools to understand, analyze, or detect.
• Banking Trojan: A Banking Trojan is malware that targets financial data by stealing banking credentials and personal information, often by mimicking trusted apps.
• Python: Python is a widely used, beginner-friendly programming language valued for its readability, versatility, and broad range of applications.
• Selenium: Selenium is a tool for automating web browsers, mainly for testing, but it can also be exploited by attackers to spread malware.
• Process Hollowing: Process hollowing is a technique where malware hides in a legitimate program’s memory, allowing it to evade detection and execute malicious actions.