Threat Actors Exploit WhatsApp Messages to Target Windows Systems with SORVEPOTEL Malware

**Executive Summary:** SORVEPOTEL is an active Windows-targeting malware campaign concentrated in Brazil that spreads via compromised WhatsApp accounts by sending ZIP attachments with malicious .LNK shortcuts which run obfuscated PowerShell to fetch additional modules, maintain persistence, and automatically resend the malicious archive to contacts and groups; the report includes IoCs, targeted sectors, and mitigation advice.