Warning: WhatsApp Worm Targets Brazilian Crypto Wallets and Bank Accounts

Brazilian cryptocurrency holders are being alerted about a new and sophisticated hacking campaign utilizing a worm and banking trojan that spreads through WhatsApp. This article outlines how the attack operates and provides tips for maintaining security against such threats.

Key Takeaways

A hacking campaign targeting Brazilian crypto wallets and bank accounts has emerged, using a worm and banking trojan via WhatsApp.
The malware, called "Eternidade Stealer," employs social engineering tactics, including phishing messages disguised as government notifications and investment offers.
Users are advised to verify any unsolicited links sent through messaging apps and maintain up-to-date software for added security.
If compromised, it's crucial to quickly secure all banking and crypto accounts to prevent further losses.

Warning: WhatsApp worm targets Brazilian crypto wallets, bank accounts

Current Threats to Brazilian Crypto Holders

Brazilian cryptocurrency holders must remain vigilant against an advanced hacking campaign that is leveraging a hijacking worm and banking trojan through WhatsApp messages.

Recent findings from Trustwave's cybersecurity division, SpiderLabs, reveal that a banking trojan known as “Eternidade Stealer” is being disseminated via social engineering methods on WhatsApp. These methods include misleading communications such as “fake government programs,” delivery updates, or messages from acquaintances and fraudulent investment groups.

"WhatsApp continues to be a prominent target within Brazil's cybercrime landscape. Over the last two years, cybercriminals have honed their strategies, taking advantage of the app's widespread use to distribute banker trojans and information-stealing malware," noted SpiderLabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi.

Understanding the Attack Process

To put it simply, clicking on a worm link received through WhatsApp triggers a sequence that infects the user’s device with both the worm and the banking trojan.

The worm hijacks the user's account and garners access to the contact list. It uses “smart filtering” techniques to skip over business contacts and groups, focusing instead on individual contact targets.

In parallel, the banking trojan is automatically downloaded onto the user's device, silently deploying the Eternidade Stealer in the background. This enables it to scan for financial information and credentials related to an array of Brazilian banks, fintechs, and crypto exchanges and wallets.

Infographic explaining how the malware attacks devices and how the hack progresses.

Evasive Actions by the Malware

The malware also employs a clever strategy to avoid detection and shutdown. Instead of connecting to a fixed server, it monitors a designated Gmail account to receive new commands via email. This allows hackers to change orders through new email messages.

“One notable feature of this malware is that it uses hardcoded credentials to access its email account, which it relies on to retrieve its command and control (C2) server. This innovative approach helps it to update its C2, maintain persistence, and evade detection or takedown efforts at the network level. If the malware cannot connect to the email account, it resorts to a hardcoded backup C2 address,” the report stated.

According to crypto analytics organization Chainalysis, Brazil is leading crypto adoption in Latin America and stands fifth on the firm’s 2025 Global Crypto Adoption Index. This index considers various factors, including the country's utilization of diverse crypto services, population size, and purchasing power.

Tips to Enhance Your Security

Users of platforms like WhatsApp should exercise caution regarding any links they receive, even from recognizable contacts.

A useful precaution is to reach out via a different communication app to confirm if the link is safe. Be particularly suspicious of links that arrive unexpectedly without adequate context.

Keeping software current can also mitigate risks from vulnerabilities targeting outdated versions, while antivirus software may help detect potential threats.

In the event that a hack occurs, it is vital to promptly freeze all access points to banking and crypto accounts to prevent further loss. Keeping track of funds can assist exchanges, researchers, or authorities in determining where the assets have moved, potentially allowing them to freeze the hackers' wallets.

Magazine: ‘Help! My robot vac is stealing my Bitcoin’: When smart devices attack