Cybersecurity Researchers Warn of Rapidly Spreading Worm Delivering “Eternidade Stealer”
Brazilian cryptocurrency users are being urged to stay alert following the discovery of a sophisticated WhatsApp-based malware campaign that targets digital wallets, bank accounts and financial logins. Cybersecurity researchers say the attack uses a combination of a hijacking worm and a powerful banking trojan designed to steal sensitive financial data.
According to a detailed report from Trustwave SpiderLabs, the trojan — identified as “Eternidade Stealer” — is spreading through fraudulent WhatsApp messages posing as government programs, delivery alerts, investment groups, or messages from trusted contacts.
SpiderLabs researchers Nathaniel Morales, John Basmayor and Nikita Kazymirskyi said:
“WhatsApp continues to be one of the most exploited communication channels in Brazil’s cybercrime ecosystem. Over the past two years, threat actors have refined their tactics, using the platform’s immense popularity to distribute banker trojans and information-stealing malware.”
The infection begins the moment a victim clicks the malicious link, triggering an automated download of both the worm and the trojan.
How the Attack Works
Once activated, the worm hijacks the victim’s WhatsApp account, accesses their contact list and uses “smart filtering” to avoid business contacts and groups. By focusing on individuals, attackers increase the likelihood of spreading the malware further.
Meanwhile, the banking trojan quietly deploys the Eternidade Stealer, which scans for financial credentials tied to Brazilian banks, fintech apps, and crypto exchanges or wallets. This includes login details, stored passwords, and sensitive transactional data.
One of the malware’s most advanced features is its command-and-control (C2) evasion technique. Instead of communicating with a fixed server, the trojan checks a hardcoded Gmail account for new instructions. “This clever method allows attackers to update commands at any time while avoiding network-level detection or shutdown,” the report noted.
If the Gmail account becomes inaccessible, the malware switches to a fallback C2 server to maintain persistence.
Rising Risk Amid High Crypto Adoption
Chainalysis data shows Brazil ranks first in Latin America for crypto adoption and fifth globally in the 2025 Crypto Adoption Index — making it a prime target for financially motivated cybercrime.
Security experts recommend confirming suspicious links through another messaging platform, avoiding unexpected messages that demand quick action, and keeping devices updated. Anti-virus tools can detect some variants, but victims should immediately freeze bank and crypto access points if compromised.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.