WhatsApp Worm Spreads Eternidade Stealer Banking Trojan in Brazil

Researchers reported a Brazil-focused malware campaign that hijacks WhatsApp Web sessions to spread a malicious ZIP archive and deploy the Eternidade Stealer banking trojan. The infection chain uses an obfuscated VBScript downloader, an MSI dropper, an AutoIt loader, and a final Delphi-based payload, while a parallel Python-based worm installs Selenium and ChromeDriver to steal contacts and automatically send phishing messages to the victim’s WhatsApp contacts. The malware is heavily localized, checking for Portuguese (Brazil) language settings and focusing on Brazilian banks, fintech services, and cryptocurrency platforms.

Once installed, the malware profiles the host, enumerates security products, monitors browser history and banking activity, and uses overlays and credential theft when targeted financial services are detected. Analysts said later stages are decrypted and loaded in memory, including reflective loading and process hollowing into svchost.exe, while command-and-control relies on attacker infrastructure including a PHP server, 013net.com.br, and IMAP over SSL with hardcoded email credentials to retrieve updated infrastructure, with a fallback domain if that fails. The campaign, also tracked as a Water-Saci/SorvePotel variant and compared with older Brazilian banking trojans such as Casbaneiro, shows an evolving effort to combine messaging-platform worming with banking fraud and credential theft.