Beware of Sorvepotel: New WhatsApp Virus Stealing Cryptocurrencies in Brazil (October 2025)
- What Is the Sorvepotel Virus?
- How Does the Attack Work?
- Why Is This Particularly Dangerous?
- Historical Context: Brazil’s Crypto Crime Wave
- How to Protect Yourself
- FAQ: Sorvepotel Malware
A new malware dubbed "Sorvepotel" is wreaking havoc in Brazil, targeting WhatsApp users to siphon off their cryptocurrency holdings. Cybersecurity experts warn that this sophisticated attack leverages social engineering to bypass two-factor authentication, with losses already reported in the millions. Here’s what you need to know to protect your digital assets.
What Is the Sorvepotel Virus?
The Sorvepotel malware disguises itself as a legitimate WhatsApp update or promotional offer. Once installed, it gains access to victims’ devices, harvesting login credentials for crypto wallets and exchanges. Unlike previous threats, Sorvepotel specifically targets Brazilian users by mimicking localized banking alerts and government notices.
How Does the Attack Work?
Victims receive a WhatsApp message urging them to click a LINK to "claim unread messages" or "verify account security." The link downloads a malicious APK file (for Android) or redirects to a phishing page (for iOS). According to BTCC security analyst Rafael Menezes, "The malware uses keylogging and screen mirroring to capture wallet seed phrases during transactions."
Why Is This Particularly Dangerous?
Three factors make Sorvepotel stand out:
- Timing: Attacks surged during Brazil’s October 2025 tax season, when users expect financial institution communications.
- Targeting: Focuses on mid-tier crypto holders (portfolios worth $5K–$50K) who often skip enterprise-grade security.
- Persistence: Remains dormant until victims access wallets like MetaMask or exchange apps such as BTCC or Mercado Bitcoin.
Historical Context: Brazil’s Crypto Crime Wave
This isn’t Brazil’s first rodeo with crypto malware. In 2023, the "Cascadura" trojan stole $17M from P2P traders. However, Sorvepotel’s WhatsApp vector marks an escalation. As CoinMarketCap data shows, Brazil ranks third globally in crypto adoption—making it a lucrative target.
How to Protect Yourself
Follow these steps immediately:
- Verify senders: Official entities won’t request sensitive data via WhatsApp.
- Use hardware wallets: Trezor or Ledger devices prevent seed phrase exposure.
- Enable whitelisting: Restrict withdrawals to pre-approved addresses on exchanges like BTCC.
FAQ: Sorvepotel Malware
Can Sorvepotel affect iPhone users?
Yes, but differently. iOS attacks rely on phishing pages rather than app installations due to Apple’s stricter app review process.
Which cryptocurrencies are being stolen?
Chainalysis reports bitcoin (BTC) and stablecoins like USDT account for 78% of stolen funds, likely for easier liquidation.
Has anyone been arrested?
Not yet. Brazil’s Federal Police are investigating IP trails routed through Paraguay.
