Maverick Fileless Trojan Turns Infected Phones into WhatsApp Worms to Steal Banking and UPI Credentials

Kaspersky GReAT uncovered a large fileless banking Trojan campaign in Brazil distributing a new threat called 'Maverick' via WhatsApp ZIP attachments containing malicious LNK shortcuts that launch PowerShell to load all stages in memory. Maverick performs geochecks to limit infections to Brazilian systems, uses WPPConnect to self-propagate through hijacked WhatsApp Web sessions, targets dozens of Brazilian banks and crypto platforms with capabilities such as screenshots, keylogging, input control and phishing overlays, communicates with C2 over SSL with custom certificates and authentication, stores only a small bootstrap in Startup for persistence, and Kaspersky telemetry reported ~62,000 blocked infection attempts in the first ten days of October 2025.