Malware Analysis • Threat Hunting

      SORVEPOTEL Deep Dive: Analyzing the LNK-to-PowerShell Kill Chain Hijacking WhatsApp Web for Enterprise Propagation    

By CyberDudeBivash • October 04, 2025 • Technical Threat Analysis

 cyberdudebivash.com |       cyberbivash.blogspot.com 

Disclosure: This is a technical analysis for security professionals. It contains affiliate links to relevant security solutions and training. Your support helps fund our independent research.

 Technical Analysis: Table of Contents 

1. Chapter 1: Part 1 — The Initial Access (The Weaponized LNK File)
2. Chapter 2: Part 2 — The Payload (The Fileless PowerShell Script)
3. Chapter 3: Part 3 — The Propagation (Hijacking the WhatsApp Session)
4. Chapter 4: The Defender’s Playbook — A Threat Hunting Guide for SOCs

Following our **initial public alert on the SORVEPOTEL worm**, this is the deep-dive technical analysis for security practitioners. This report reverse-engineers the worm’s kill chain, focusing on its use of a malicious LNK file to trigger a fileless PowerShell payload, which then hijacks WhatsApp Web session tokens for enterprise-wide propagation.

Chapter 1: Part 1 — The Initial Access (The Weaponized LNK File)

The attack begins with a classic social engineering lure, delivered via a ZIP archive. Inside is not an executable, but a carefully crafted Windows Shortcut (.LNK) file. Attackers favor LNK files because they are less scrutinized by users and some legacy security tools.

The malicious LNK file does not point to a program. Instead, its “Target” property is populated with a command to launch PowerShell with an encoded payload. It looks like this:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -WindowStyle Hidden -Exec Bypass -EncodedCommand [LONG_BASE64_STRING]

When the user clicks the shortcut, this command executes silently in the background, triggering the next stage of the attack.

Chapter 2: Part 2 — The Payload (The Fileless PowerShell Script)

The Base64-encoded command decodes into a sophisticated, multi-stage PowerShell script that runs entirely in memory. Its primary function is to locate and steal the session tokens for WhatsApp Web.

The Reconnaissance Phase:

The script first searches the local filesystem for the user data directories of Chromium-based browsers (Chrome, Edge). It specifically targets the following path:

`%LocalAppData%\[Google\Chrome | Microsoft\Edge]\User Data\Default\Local Storage\leveldb\`

This directory contains the LevelDB databases where websites, including WhatsApp Web, store their session information.

Chapter 3: Part 3 — The Propagation (Hijacking the WhatsApp Session)

Once the `leveldb` directory for `web.whatsapp.com` is located, the PowerShell script reads the database files. It searches for and extracts the specific authentication tokens (`WABrowserId`, `WASecretBundle`, etc.) that prove the user’s session is active and legitimate.

With these tokens in hand, the worm now has everything it needs to impersonate the user. It uses PowerShell’s `Invoke-WebRequest` cmdlet to make direct, authenticated calls to the WhatsApp Web API. It programmatically queries for the user’s entire contact list and then iterates through it, sending the malicious link and lure message to every contact and group. The worm has now successfully propagated.

Chapter 4: The Defender’s Playbook — A Threat Hunting Guide for SOCs

Detecting this **fileless threat** is impossible with traditional AV. It requires a modern **EDR** and a hypothesis-driven hunting approach.

Key Hunting Queries for Your EDR:

• Hunt for the Initial Execution:** Find the LNK-to-PowerShell TTP.
  ParentProcess:explorer.exe AND ProcessName:powershell.exe AND CommandLine CONTAINS "-EncodedCommand"
• Hunt for the Session Theft:** This is a high-fidelity query. PowerShell should almost never be accessing browser storage.
  ProcessName:powershell.exe AND FileAccessEvent ON PATH CONTAINS "Local Storage\\leveldb"
• Hunt for the Propagation:** While a browser connecting to WhatsApp is normal, PowerShell doing so is a massive red flag.
  ProcessName:powershell.exe AND NetworkConnection to destination_domain="web.whatsapp.com"

 Visibility is Your Weapon: This entire hunt is impossible without the deep process, file, and network telemetry that a modern EDR provides. **Kaspersky’s XDR platform** is designed to provide this unified visibility and enable these advanced hunts.  

Get Elite Threat Hunting Playbooks

Subscribe for advanced hunting guides, malware analysis, and strategic insights.         Subscribe  

About the Author

CyberDudeBivash is a cybersecurity strategist with 15+ years in malware analysis, threat hunting, and incident response, advising SOC teams and CISOs across APAC. [Last Updated: October 04, 2025]

  #CyberDudeBivash #SORVEPOTEL #MalwareAnalysis #ThreatHunting #PowerShell #WhatsApp #CyberSecurity #InfoSec #EDR #DFIR