Loading story…
Researchers reported that the Chaes malware family has evolved into a fourth major variant, Chae$ 4, with campaigns targeting financial and logistics organizations and users primarily in Latin America. Morphisec said the newer strain has been heavily reworked, with much of the malware rewritten in Python and expanded into modular components that support reconnaissance, credential theft, browser-data theft, file exfiltration, and theft of banking, cryptocurrency, and WhatsApp data. The malware is delivered through malicious MSI installers disguised as Java or antivirus software, persists through scheduled tasks, migrates into legitimate processes, and uses encrypted communications, WebSocket-based C2, and a DGA to dynamically resolve command-and-control infrastructure.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Morphisec said Chae$ 4 increased in sophistication across multiple iterations from April to June 2023. The variant was extensively reworked, including a predominant rewrite in Python and added stealth and encryption features.
Morphisec observed attacks involving the previously unknown Chae$ 4 variant beginning in January 2023. The attacks primarily affected clients in the logistics and financial sectors in Latin America.
Tempest's SideChannel research group published additional findings on Chaes in December 2022. Its research reported that the malware had adopted WMI for system data collection.
A response attributed to the Chaes threat actor was released in February 2022 following Avast's publication. The content does not provide further details on the response.
In January 2022, Avast published research detailing Chaes' refined infection chain, enhanced command-and-control communications, and newly integrated modules. Avast also said it shared its findings with Brazil's CERT.
Avast observed increased Chaes activity during Q4 2021, including infection attempts affecting more than 66,605 Brazilian customers. The campaign used over 800 compromised websites, all observed as WordPress sites.
Cybereason first publicly reported the Chaes malware family in November 2020. This established Chaes as a Brazil- and Latin America-focused threat targeting e-commerce users.
Cybereason reported that the original Chaes malware had been active since at least mid-2020, marking the earliest known activity for the malware family.
Morphisec Threat Labs identified Chae$ 4 as a fourth major and previously unknown Chaes variant. The report described its modular architecture, WebSocket-based C2, DGA-based C2 resolution, and targeting of banking, browser, cryptocurrency, WhatsApp, and CMS-related data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat campaign known as Water Saci has escalated its attacks on Brazilian financial institutions and cryptocurrency exchanges by deploying a new Python-based malware variant. This campaign leverages artificial intelligence (AI) to convert previous PowerShell propagation scripts into Python, resulting in broader browser compatibility, improved error handling, and faster automation of malware delivery through WhatsApp Web. The attackers use a highly layered attack chain involving multiple file formats such as HTA files, ZIP archives, and PDFs to evade detection and complicate analysis, with the ultimate goal of stealing sensitive data and monitoring user activity on compromised machines. The campaign primarily targets enterprise users of WhatsApp in Brazil, exploiting social engineering tactics to deliver malicious payloads through convincing messages from trusted contacts. Researchers warn that the use of AI-driven code conversion and multi-format delivery methods marks a significant evolution in the threat landscape, making these attacks more sophisticated and harder to detect. While the campaign is currently concentrated in Brazil, there is concern it could expand to other Latin American countries as the techniques continue to evolve.
Jun 29, 2026
A wave of sophisticated Python-based malware and stealer campaigns has been observed, leveraging advanced evasion techniques and targeting a wide range of platforms. Notable threats include a Python malware that hides within PNG-disguised RAR files and injects payloads into legitimate executables, as well as the Xillen Stealer v4, which employs polymorphic evasion to target over 100 browsers and 70 cryptocurrency wallets, including DevOps environments. Other campaigns involve the Eternidade Stealer, a Python WhatsApp worm using IMAP email for covert command and control and deploying overlays to target Brazilian banking users, and a multi-layer Python RAT distributed via PyPI typosquatting, which bypasses scanners using XOR encryption. Additionally, attackers are exploiting messaging platforms such as WhatsApp with sophisticated worms that hijack sessions and deploy banking trojans like Astaroth. Another campaign involves a trojanized VPN installer that delivers the NKNShell backdoor, utilizing P2P blockchain and MQTT protocols for covert C2 communications. These incidents highlight the increasing complexity and diversity of Python-based malware, the use of novel distribution and evasion tactics, and the growing risk to both individual users and enterprise environments across multiple vectors, including messaging apps, software supply chains, and browser extensions.
Jun 29, 2026
The **Chameleon** Android banking trojan has evolved from consumer-focused banking fraud into campaigns aimed at employees, broadening the risk from personal account theft to potential compromise of **business banking access**. First observed targeting users in Australia and Poland while impersonating brands such as **CoinSpot**, a government agency, and Poland’s **IKO** bank, the malware later appeared in campaigns against victims in Canada and Europe disguised as a **CRM application** for hospitality workers and, separately, as a fake bank security app. Researchers said the operators appear to be using trusted-brand impersonation and workplace-themed lures to steal credentials from devices that may also provide access to corporate financial systems. Chameleon abuses Android’s **Accessibility Service** to automate permissions, disable **Google Play Protect**, interfere with uninstallation, and carry out credential theft through overlays, keylogging, cookie theft, lock grabbing, and **SMS interception**. In the newer activity, operators used a **multi-stage infection chain** with a dropper designed to bypass Android 13+ restrictions before installing the final payload under the pretense of reinstalling the app. Earlier analysis also found the malware communicating with a command-and-control server at `146.70.41.143:7242` and exfiltrating device details, cookies, keylogs, and SMS data, while retaining an unused runtime payload-loading capability via `DexClassLoader`, indicating continued development beyond its already mature banking trojan features.
Aug 15, 2026