Security

Nikita

Safety

Surge

<p>A newly identified WhatsApp-based worm-and-trojan campaign in Brazil is compromising crypto wallets and bank accounts through a rapidly spreading malware cluster dubbed Eternidade.</p><h2 id="researchers-identify-new-multi-stage-threat">Researchers Identify New Multi-Stage Threat</h2><p><a href="https://cryptodaily.co.uk/2025/11/reuters-brazil-considers-taxing-international-crypto-payments" rel="noopener noreferrer nofollow">Brazilian</a> crypto users are being warned about an emerging malware operation that leverages WhatsApp hijacking to spread a banking trojan designed to harvest financial credentials. Trustwave SpiderLabs researchers have disclosed that the campaign revolves around a newly identified stealer known as Eternidade, a Delphi-based malware capable of dynamically updating its command-and-control infrastructure and stealthily collecting data from victims.</p><p>Researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi noted that WhatsApp remains central to Brazil’s cybercriminal ecosystem, stating,&nbsp;</p><blockquote><p>“WhatsApp continues to be one of the most exploited communication channels in Brazil’s cybercrime ecosystem. Over the past two years, threat actors have refined their tactics, using the platform’s immense popularity to distribute banker trojans and information-stealing malware.”</p></blockquote><h2 id="how-the-infection-chain-works">How the Infection Chain Works</h2><p>According to the research team, the ongoing operation begins with social engineering messages delivered via WhatsApp. These lures mimic familiar formats, such as delivery notifications, fraudulent investment groups, and “fake government programs”, to trick recipients into clicking malicious links.</p><p>Once clicked, the link triggers the deployment of both a hijacking worm and the Eternidade banking trojan. The worm immediately takes control of the victim’s WhatsApp account, extracts the contact list, and selectively targets individual contacts using “smart filtering,” bypassing business groups to maximize the likelihood of personal engagement.</p><p>Simultaneously, a trojan file is silently downloaded on the device. This component installs the Eternidade Stealer in the background, enabling attackers to scan for credentials tied to major Brazilian banks, fintech platforms, and cryptocurrency exchanges and wallets.</p><h2 id="adaptive-command-and-control-via-gmail">Adaptive Command-and-Control via Gmail</h2><p>One of the campaign’s most crucial traits is its unconventional method for receiving updated commands. Instead of relying on static server addresses, Eternidade uses hardcoded credentials to log into a Gmail account via IMAP. This allows the attackers to send updated instructions simply by emailing the controlled account.</p><p>The researchers highlighted this technique in their report:&nbsp;</p><blockquote><p>“One notable feature of this malware is that it uses hardcoded credentials to log into its email account, from which it retrieves its C2 server. It is a very clever way to update its C2, maintain persistence, and evade detections or takedowns on a network level. If the malware cannot connect to the email account, it uses a hardcoded fallback C2 address.”</p></blockquote><h2 id="related-malware-activity">Related Malware Activity</h2><p>The Eternidade operation follows closely behind another Brazil-focused malware wave known as Water Saci, which used a WhatsApp Web worm called SORVEPOTEL to distribute Maverick, a .NET-based banking trojan linked to earlier Coyote malware variants. These incidents underscore a persistent trend in the region: the use of WhatsApp as a primary vector and the enduring reliance on Delphi-based tools for malware development.</p><h2 id="safety-recommendations">Safety Recommendations</h2><p>Security experts are advising WhatsApp users to avoid clicking unfamiliar links, even when sent by trusted contacts. Confirming suspicious messages through alternate communication channels is recommended, particularly when little context accompanies the link.</p><p>Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice</p>

Brazil Faces Surge in WhatsApp Worm Attacks Targeting Crypto and Banking Apps

Table of Contents

Crypto Daily™

Other articles published on Dec 6, 2025

ETH Breaks Out of Its Daily Wedge Structure and Builds Momentum Toward $5,000

Bitcoin Price Weakens, Raising Concerns of Return to $80K Zone if Support Fails

Do Kwon Facing 12-Year Prison Request in Terraform Labs Case

NFT sales show modest $77M, Ethereum NFT sales drop 13%

Pi Network Introduces New AI Upgrade to Accelerate KYC and Mainnet Migration

Binance's CZ and MicroStrategy's Saylor Meet in Dubai

Join our free newsletter for daily crypto updates!