Scworld

Water Saci Threat Evolves with AI and Multi-Format Malware via WhatsApp

First seen 4 Dec 2025, 19:42 UTC • Feeds.Trendmicro

•80% similarity •24.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Water Saci threat operation has advanced its tactics by using WhatsApp to distribute malicious HTML Application files and PDFs targeting Brazilian users. Attackers are leveraging AI for code conversion and employing a layered infection chain that includes various file formats and scripting languages to enhance malware delivery and propagation.

ThreatCluster AI How this analysis works

Attack Flow

12 entities, 11 inferred relationships (STIX 2.1).

Threat Actor (1)

Water Saci

Technique (7)

Malware
Phishing
T1059.001 - PowerShell
T1059.005 - Visual Basic
T1059.007 - HTML Application
T1059 - Command and Scripting Interpreter
T1113 - Screen Capture

Indicator (2)

serverseistemasatu.com
terra.com.br

Affected Platform (1)

Tool (1)

PowerShell

Relationships

Water Saci uses PowerShell
Water Saci uses Malware
Water Saci uses Phishing
Water Saci uses T1059.001 - PowerShell
Water Saci uses T1059.005 - Visual Basic
Water Saci uses T1059.007 - HTML Application
Water Saci related to serverseistemasatu.com
Water Saci related to terra.com.br
Water Saci related to T1059 - Command and Scripting Interpreter
Water Saci related to T1113 - Screen Capture
Water Saci related to WhatsApp

Community

Browse all →

Tracked Entities in This Story

Water Saci WhatsApp

Water Saci Threat Evolves with AI and Multi-Format Malware via WhatsApp

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story