Trend Research has identified an active malware campaign named Water Saci that spreads via WhatsApp using malicious ZIP file attachments. The malware, known as SORVEPOTEL, hijacks WhatsApp accounts to propagate itself among contacts, primarily targeting Brazilian financial institutions.