Warning: WhatsApp Worm Targets Brazilian Crypto Wallets, Bank Accounts

Why It Matters

The campaign threatens billions in crypto and banking assets in Brazil, highlighting the growing convergence of messaging platforms and financial cybercrime and prompting heightened security measures for both consumers and financial institutions.

Summary

Trustwave’s SpiderLabs has uncovered a new WhatsApp‑based malware campaign targeting Brazilian crypto holders and bank customers. The attack delivers a worm that hijacks the victim’s WhatsApp account and a banking trojan called “Eternidade Stealer,” which silently installs a stealer that harvests credentials for banks, fintechs, crypto exchanges and wallets. The malware spreads through social‑engineered messages masquerading as government notices, delivery alerts or friend referrals, and uses a hard‑coded Gmail account for command‑and‑control to evade takedowns. Users are advised to treat all WhatsApp links with suspicion, keep software updated, and freeze financial accounts if compromise is suspected.