WhatsApp Malware

A new malware campaign has been uncovered that uses WhatsApp to launch self-propagating malware outbreaks, targeting financial institutions and cryptocurrency exchanges, the campaign uses a newly identified malware called SORVEPOTEL to spread rapidly across Windows systems, it prioritizes speed and social engineering, abusing the trust users place in WhatsApp conversations, the infection starts with a phishing message sent from a compromised WhatsApp account, which contains a malicious ZIP file disguised as a legitimate document, when opened, the archive reveals a malicious Windows shortcut file that silently executes a PowerShell script, this script downloads and executes additional payloads directly from attacker-controlled domains.