Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C

Trend Research describes the active Water Saci (SORVEPOTEL) campaign that weaponizes WhatsApp Web to propagate malicious ZIPs: victims who download an attached ORCAMENTO-2025*.zip execute an obfuscated VBS which launches a PowerShell fileless loader (tadeu.ps1) that hijacks Chrome/WhatsApp sessions, harvests contacts, and automates personalized distribution of base64-encoded ZIP payloads; the malware supports resilient C2 via IMAP (email) and HTTP polling, includes persistence and anti-analysis checks, and is focused on Portuguese-speaking (Brazilian) targets, with IoCs and mitigation guidance provided.