ThreatCluster

Maverick Malware Targets WhatsApp Web Users in Brazil

First seen 12 Nov 2025, 21:25 UTC • •29

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Maverick malware is a banking trojan that specifically targets WhatsApp Web users in Brazil, aiming to hijack accounts and steal credentials from Latin American financial institutions. It propagates through malicious ZIP archives using VBScript and PowerShell, enabling it to automate browser sessions and evade detection. Cybersecurity firms have identified its connections to older threats and its sophisticated evasion tactics.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 182d ago How this analysis works

More articles in this cluster (2)

Threat Graph

20 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

Water Saci

Technique (8)

Malware
Phishing
Trojan
Worm
T1059.001 - PowerShell
T1059.005 - VBScript
T1059.005 - Visual Basic
T1566 - Phishing

Campaign (1)

Maverick Malware Campaign

Malware (3)

Coyote
Maverick
Sorvepotel

Tool (7)

Chrome
WhatsApp Web
Chromedriver
Orcamento.vbs
PowerShell
Selenium
VBScript

Relationships

Water Saci uses Coyote
Water Saci uses Maverick
Water Saci uses Sorvepotel
Water Saci uses Chrome
Water Saci uses WhatsApp Web
Water Saci uses Chromedriver
Water Saci uses Orcamento.vbs
Water Saci uses PowerShell
Water Saci uses Malware
Water Saci uses Phishing
Water Saci uses Trojan
Water Saci uses Worm
Water Saci uses T1059.001 - PowerShell
Maverick Malware Campaign attributed to Water Saci
Maverick Malware Campaign uses Coyote
Maverick Malware Campaign uses Maverick
Maverick Malware Campaign uses Sorvepotel
Water Saci related to T1059.005 - VBScript
Water Saci related to T1059.005 - Visual Basic
Water Saci related to T1566 - Phishing
Water Saci related to Selenium
Water Saci related to VBScript

Following this threat?

Track Water Saci and Coyote in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by…