New Banking Malware Abusing WhatsApp to Gain Complete Remote Access to Your Computer
A new banking Trojan named Maverick has been identified in Brazil, utilizing WhatsApp as a key distribution method. The malware, detected in mid-October 2025, has resulted in over 62,000 blocked infection attempts within the first ten days.
A new banking Trojan named Maverick has been identified in Brazil, utilizing WhatsApp as a key distribution method. The malware, detected in mid-October 2025, has resulted in over 62,000 blocked infection attempts within the first ten days.
The malware targets Brazilian users through Portuguese-language messages that include malicious ZIP archives, bypassing WhatsApp's security filters. These messages, often disguised as bank notifications or important documents, contain ZIP files with a .LNK file that initiates the attack sequence. Upon execution, the malware uses commands via cmd.exe and PowerShell, reaching out to command-and-control servers to download additional payloads.
Maverick operates entirely in a fileless manner, loading all malicious components directly into memory, which complicates detection. Researchers identified significant code similarities with Coyote, another Brazilian banking Trojan, while noting Maverick's use of artificial intelligence for certificate decryption and code development.
The Trojan targets victims by verifying the system's timezone, language, region settings, and date formats to ensure it is in Brazil before activation. If these checks fail, the malware terminates, preventing analysis from other regions. Once activated, Maverick enables extensive surveillance capabilities, including screenshot capture, browser monitoring, keylogging, mouse control, and phishing overlays targeting 26 Brazilian financial institutions, six cryptocurrency exchanges, and one payment platform.
A new banking Trojan named Maverick has been identified in Brazil, utilizing WhatsApp as a key distribution method.
Maverick employs a self-propagation mechanism using WPPConnect, an open-source WhatsApp Web automation project, to control compromised accounts and distribute malicious messages to the victim's contacts. This approach allows for rapid spread through WhatsApp.
The malware uses advanced encryption techniques, including HMAC-256 signature validation and encrypted shellcodes with Donut loaders. The decryption process involves XOR encryption, with keys stored in the final bytes of downloaded binaries. The sophisticated encryption and code obfuscation significantly hinder reverse engineering.
Decryption Process
$keySize = [BitConverter]::ToInt32($binary[-4..-1], 0) $keyStart = $binary.Length - 4 - $keySize $xorKey = $binary[$keyStart..($keyStart + $keySize - 1)]
Security products from Kaspersky provide detection and protection from this threat, with specific verdicts for the initial and subsequent infection stages.
Based on reporting by Cyber Security News.