WhatsApp Worm Infects Devices and Compromises User Banking Information

There has been a troubling revelation in the cybersecurity community that cybercriminals continue to weaponise trusted digital ecosystems by deploying highly sophisticated malware campaigns that use WhatsApp’s messaging platform to infiltrate users throughout Brazil, demonstrating that cybercriminals continue to use trusted digital ecosystems to their advantage. 

This large-scale operation, which was detected on September 29, 2025, exhibits unprecedented technical precision and social engineering skills, manipulating user trust in order to achieve rapid and silent propagation of the virus.

There has been an increased use of WhatsApp Web by the attackers in attempts to propagate malicious LNK and ZIP files disguised as harmless attachments sent from compromised contacts. 

The attackers have chosen to send misleading messages that convincingly mimic genuine communication to lure their victims into execution.

The moment that an unsuspecting recipient opens a file that contains malware on a desktop system, the malware stealthily executes a fileless infection chain, which is designed to steal credentials from financial institutions as well as cryptocurrency exchanges as they conduct their transactions. 

Researchers have determined that the campaign was linked to a broader operation known as “Water Saci,” which shows a level of sophistication and

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.