Loading story…
Researchers reported a Brazil-focused malware campaign that hijacks WhatsApp Web sessions to spread a malicious ZIP archive and deploy the Eternidade Stealer banking trojan. The infection chain uses an obfuscated VBScript downloader, an MSI dropper, an AutoIt loader, and a final Delphi-based payload, while a parallel Python-based worm installs Selenium and ChromeDriver to steal contacts and automatically send phishing messages to the victim’s WhatsApp contacts. The malware is heavily localized, checking for Portuguese (Brazil) language settings and focusing on Brazilian banks, fintech services, and cryptocurrency platforms.
Once installed, the malware profiles the host, enumerates security products, monitors browser history and banking activity, and uses overlays and credential theft when targeted financial services are detected. Analysts said later stages are decrypted and loaded in memory, including reflective loading and process hollowing into svchost.exe, while command-and-control relies on attacker infrastructure including a PHP server, 013net.com.br, and IMAP over SSL with hardcoded email credentials to retrieve updated infrastructure, with a fallback domain if that fails. The campaign, also tracked as a Water-Saci/SorvePotel variant and compared with older Brazilian banking trojans such as Casbaneiro, shows an evolving effort to combine messaging-platform worming with banking fraud and credential theft.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
SpiderLabs identified older samples similar to the Eternidade/WhatsApp campaign from January 2025, indicating the actor had been developing this malware set before the later reports.
ISH Tecnologia published an analysis of the WhatsWorm campaign, describing WhatsApp-delivered ZIP lures, a VBS downloader, MSI and AutoIT stages, and a final Delphi-based Eternidade Stealer payload. The report also disclosed specific infrastructure, runtime string decryption details, and hardcoded IMAP email credentials used for C2.
K7 Labs reported a Brazil-focused phishing campaign it described as a Water-Saci variant using the SorvePotel malware family. The report detailed a ZIP/VBS infection chain, WhatsApp Web abuse via Selenium and injected JavaScript, and an MSI-delivered banking trojan that loads in memory and injects into svchost.
LevelBlue SpiderLabs reported a Brazilian banking and credential-stealing campaign using a Delphi malware family it named Eternidade Stealer, distributed through WhatsApp hijacking and social engineering. The analysis described a VBScript-to-MSI infection chain, a Python WhatsApp worm, and IMAP-based C2 retrieval.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
ish.com.br
Open sourcelabs.k7computing.com
Open sourcelevelblue.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers have identified a new campaign targeting Brazilian users in which the Eternidade Stealer, a Delphi-based banking trojan, is distributed through a WhatsApp worm. The attack leverages social engineering and WhatsApp hijacking, with the threat actor deploying a Python script—marking a shift from previous PowerShell-based methods—to hijack WhatsApp Web sessions and spread malicious attachments. The campaign uses an obfuscated Visual Basic Script as the initial infection vector, which then drops a batch script responsible for delivering two payloads, including the Python-based worm. The malware utilizes the Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses, allowing the attacker to update C2 infrastructure as needed. This activity is part of a broader trend in Brazil, where WhatsApp's ubiquity makes it a favored vector for distributing banking trojans and information stealers. The use of Delphi for malware development remains prevalent in Latin America due to its technical efficiency and regional familiarity. Researchers note that this campaign represents an evolution in tactics, building on previous attacks such as Water Saci, and highlights the increasing sophistication of social engineering and malware propagation techniques in the region's cybercrime ecosystem.
Jun 29, 2026
The **Astaroth** banking trojan has added a spambot component that hijacks victims’ active **WhatsApp Web** sessions to distribute malicious ZIP attachments, with activity primarily targeting users in Brazil. According to CrowdStrike, the malware launches a headless **Chromium** or **Microsoft Edge** browser through WebDriver, suppresses automation indicators, checks whether the victim is already logged in to WhatsApp Web, and then uses the legitimate **WPPConnect/WA-JS** library to enumerate contacts and send messages that appear to come from the victim’s own account. The spambot is designed to maximize delivery while reducing suspicion, filtering out groups, broadcasts, linked devices, unsaved contacts, the victim’s own account, and non-Brazilian phone numbers, while tailoring Portuguese greetings by time of day before sending lures. CrowdStrike also found substantial code and configuration overlap with the earlier **Vareg** spambot—including nearly identical contact filtering, message delivery logic, and delay behavior—indicating likely code sharing or a common developer; researchers published detection guidance, a **YARA** rule, and related filesystem, telemetry, hash, and domain indicators tied to the campaign.
Jul 31, 2026
A new banking Trojan named Maverick has been identified targeting users in Brazil through a sophisticated, fileless malware campaign. The infection chain begins with the distribution of malicious ZIP files containing LNK shortcuts, which are sent via WhatsApp messages. These LNK files are not blocked by WhatsApp, allowing the malware to propagate widely among Brazilian users. Once a device is infected, the Maverick Trojan leverages the open-source WPPConnect project to automate the sending of further malicious messages from the victim’s WhatsApp Web account, effectively turning compromised devices into worms that spread the malware to additional contacts. The Trojan is highly targeted, checking the infected system’s time zone, language, and regional settings to ensure it only installs on Brazilian machines. Upon successful infection, Maverick operates entirely in memory, minimizing disk activity and making detection more difficult. The malware is modular, using PowerShell and .NET components to execute its payloads. Its primary objective is to steal banking and UPI credentials by monitoring browser activity, taking screenshots, logging keystrokes, and overlaying phishing pages when users access banking websites. Maverick can also control the mouse, block the screen during sensitive operations, and terminate processes to evade detection. The campaign specifically targets 26 Brazilian banks, 6 cryptocurrency exchanges, and a major payment platform, indicating a broad financial focus. The command-and-control infrastructure is designed to verify that downloads originate from the malware itself, adding another layer of evasion. Researchers have noted significant code overlap between Maverick and the previously known Coyote Trojan, but Maverick is considered a distinct and new threat. The use of WhatsApp as a distribution vector is particularly concerning, as it exploits the trust between contacts and the widespread use of the messaging platform in Brazil. The fileless nature of the attack chain, combined with the use of legitimate open-source tools, complicates detection and remediation efforts. Security experts recommend heightened vigilance for suspicious WhatsApp messages containing attachments, especially those in Portuguese or referencing financial matters. Organizations and individuals are urged to update their security solutions and educate users about the risks of opening unsolicited files, even from known contacts. The emergence of Maverick underscores the evolving tactics of cybercriminals targeting the Brazilian financial sector and highlights the need for robust, multi-layered defenses.
Jun 29, 2026