Eternidade Stealer Trojan Targets Brazil via WhatsApp

Cybersecurity researchers have uncovered a sophisticated banking trojan called Eternidade Stealer spreading through WhatsApp messages in Brazil, targeting users' financial credentials from major banks and cryptocurrency platforms. The malware, which primarily affects desktop systems, has been active in recent weeks, with detections surging in early October as it propagates rapidly among personal contacts.

The attack begins with personalized WhatsApp messages in Portuguese, often disguised as delivery notifications, government alerts, or invitations from friends. These messages contain malicious attachments, such as ZIP files with deceptive shortcuts or obfuscated VBScript files. When users open them, the script downloads a Python-based worm that hijacks the WhatsApp Web session. The worm extracts the victim's full contact list, including names and phone numbers, and sends tailored messages to individual contacts while avoiding business or group chats to minimize detection. This automated spreading mechanism allows the malware to infect networks quickly through trusted channels.

Once deployed, the trojan uses an MSI installer to drop additional components, including AutoIt...