A WhatsApp Web–based campaign starting on September 29, 2025, targeted Brazilian users by sending ZIP attachments that contained malicious LNK files which launched multi-stage PowerShell payloads to disable defenses and fetch additional malware. The campaign used C2 domains such as zapgrande[.]com and delivered either a Selenium-based session hijacker or a banking trojan called Maverick, with possible links to the earlier Coyote campaigns. #zapgrande #Maverick
Keypoints
- Campaign began on September 29, 2025, targeting Brazil via WhatsApp Web messages that appeared to come from known contacts.
- Recipients were tricked into downloading ZIP archives (e.g., NEW-20251001_150505-XXX_XXXXXXX.zip, ORCAMENTO_XXXXXXX.zip, COMPROVANTE_20251002_XXXXXXX.zip) containing a malicious Windows LNK file.
- The LNK launched an obfuscated command that executed a Base64-encoded first-stage PowerShell which downloaded a second-stage PowerShell from C2 domains such as zapgrande[.]com.
- Second-stage PowerShell attempted defense evasion (add Defender exclusions, disable UAC) and conducted anti-analysis checks before delivering payloads.
- Observed payloads included a Selenium automation tool (used to hijack browser/WhatsApp Web sessions for self-propagation) and a .NET banking trojan named Maverick that monitored banking/crypto site traffic before installing.
- Sophos detected first-stage PowerShell activity across 400+ customer environments and 1,000+ endpoints; three unique C2 domains and additional payloads (including Selenium) were observed.
- Researchers are investigating links to earlier Coyote campaigns that used LNK-based multi-stage PowerShell chains and Donut-built payloads; attribution and evolution (Coyote → Maverick) remain under investigation.
MITRE Techniques
- [T1204] User Execution – Malicious LNK in a ZIP archive tricked recipients into launching the payload from WhatsApp Web messages: ‘the archive contained a malicious Windows LNK file that, when launched, initiated a series of malicious PowerShell commands.’
- [T1204.002] Malicious File – Shortcut – The LNK target field contained an obfuscated command that executed a Base64 PowerShell loader: ‘The target field of the LNK file contained an obfuscated Windows command that constructed and ran an initial Base64-encoded PowerShell command.’
- [T1059.001] PowerShell – Multi-stage PowerShell commands were used to download and execute next-stage payloads from C2: ‘first-stage PowerShell command covertly launched an Explorer process that downloaded the next-stage PowerShell command from a remote command and control (C2) server hosted on hxxps://www.zapgrande[.]com.’
- [T1105] Ingress Tool Transfer – Second-stage PowerShell downloaded additional tools/payloads (Selenium or Maverick) from C2 infrastructure: ‘Both payloads were delivered via the same C2 infrastructure and only to hosts that passed a set of anti-analysis checks.’
- [T1562.001] Impair Defenses – The PowerShell attempted to modify local security controls, including adding Defender exclusions and disabling UAC: ‘add an exclusion in Microsoft Defender’ and ‘disable UAC.’
- [T1059.007] JavaScript (via browser automation) – Selenium and ChromeDriver were used to control browser sessions and enable WhatsApp Web session hijacking and self-propagation: ‘the presence of the Selenium payload align[s] with … delivering … a Selenium instance with a matching ChromeDriver.’
- [T1086] PowerShell (execution) – Detection rules targeted suspicious PowerShell processes with Base64-encoded commands used in the attack chain: ‘Detects suspicious PowerShell process with command line with start of suspicious Base64 encoded commands.’
Indicators of Compromise
- [Domain] C2 server used in WhatsApp worm campaign – zapgrande[.]com, expansiveuser[.]com (and sorvetenopote[.]com)
- [File name] Malicious archive naming patterns observed in attachments – NEW-20251001_150505-XXX_XXXXXXX.zip, COMPROVANTE_20251002_XXXXXXX.zip
- [Tool] Additional payload/tool observed – Selenium with matching ChromeDriver (used for browser session control)
- [Behavioral] Suspicious PowerShell activity – Base64-encoded PowerShell commands launched from LNK and Explorer processes (detected across 1,000+ endpoints)
Read more: https://news.sophos.com/en-us/2025/10/10/whatsapp-worm-targets-brazilian-banking-customers/