The post Brazilian crypto users hit by WhatsApp malware campaign targeting crypto wallets appeared on BitcoinEthereumNews.com. Bad actors are weaponizing WhatsApp to deliver a hijacking worm and banking trojan in Brazil that targets their crypto wallets. Summary SpiderLabs has warned about a WhatsApp‑based malware campaign in Brazil that deploys a worm and banking trojan to target crypto users. The malware is able to harvest sensitive information related to the victim’s crypto exchange account and wallets. Trustwave’s cybersecurity research team SpiderLabs has uncovered a major campaign involving the Eternidade Stealer, which can quietly harvest financial information, login data, and other sensitive details associated with banking portals, fintech apps, and crypto exchanges on the victim’s device. Threat actors were found to be using complex social engineering schemes involving “fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups,” the report said. Attackers are using a two‑stage process to deliver the malicious payload that includes a WhatsApp‑propagating worm and a Delphi‑based banking trojan. When the victim clicks a worm link, it triggers an automated sequence that hijacks the WhatsApp session, downloads the MSI installer in the background, and deploys the stealer that scans for financial applications and crypto wallets. “When it detects a match, for example, a window title or process name linked to Bradesco, BTG Pactual, Binance, Coinbase, MetaMask, Trust Wallet, or another financial brand, the malware immediately decrypts and activates its next-stage payload,” Spiderlabs researchers explained. Another concerning trait of the campaign, besides its stealthy nature, is that the worm is able to access the victim’s contact list, which lets it target other potential victims. Meanwhile, it prevents detection by using “hardcoded credentials to log into its email account,” which is retrieved from a Gmail inbox controlled by the operator. By using IMAP over SSL to fetch commands, a method that blends with ordinary user email traffic, the malware is able… The post Brazilian crypto users hit by WhatsApp malware campaign targeting crypto wallets appeared on BitcoinEthereumNews.com. Bad actors are weaponizing WhatsApp to deliver a hijacking worm and banking trojan in Brazil that targets their crypto wallets. Summary SpiderLabs has warned about a WhatsApp‑based malware campaign in Brazil that deploys a worm and banking trojan to target crypto users. The malware is able to harvest sensitive information related to the victim’s crypto exchange account and wallets. Trustwave’s cybersecurity research team SpiderLabs has uncovered a major campaign involving the Eternidade Stealer, which can quietly harvest financial information, login data, and other sensitive details associated with banking portals, fintech apps, and crypto exchanges on the victim’s device. Threat actors were found to be using complex social engineering schemes involving “fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups,” the report said. Attackers are using a two‑stage process to deliver the malicious payload that includes a WhatsApp‑propagating worm and a Delphi‑based banking trojan. When the victim clicks a worm link, it triggers an automated sequence that hijacks the WhatsApp session, downloads the MSI installer in the background, and deploys the stealer that scans for financial applications and crypto wallets. “When it detects a match, for example, a window title or process name linked to Bradesco, BTG Pactual, Binance, Coinbase, MetaMask, Trust Wallet, or another financial brand, the malware immediately decrypts and activates its next-stage payload,” Spiderlabs researchers explained. Another concerning trait of the campaign, besides its stealthy nature, is that the worm is able to access the victim’s contact list, which lets it target other potential victims. Meanwhile, it prevents detection by using “hardcoded credentials to log into its email account,” which is retrieved from a Gmail inbox controlled by the operator. By using IMAP over SSL to fetch commands, a method that blends with ordinary user email traffic, the malware is able…

Brazilian crypto users hit by WhatsApp malware campaign targeting crypto wallets

Bad actors are weaponizing WhatsApp to deliver a hijacking worm and banking trojan in Brazil that targets their crypto wallets.

Summary

  • SpiderLabs has warned about a WhatsApp‑based malware campaign in Brazil that deploys a worm and banking trojan to target crypto users.
  • The malware is able to harvest sensitive information related to the victim’s crypto exchange account and wallets.

Trustwave’s cybersecurity research team SpiderLabs has uncovered a major campaign involving the Eternidade Stealer, which can quietly harvest financial information, login data, and other sensitive details associated with banking portals, fintech apps, and crypto exchanges on the victim’s device.

Threat actors were found to be using complex social engineering schemes involving “fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups,” the report said.

Attackers are using a two‑stage process to deliver the malicious payload that includes a WhatsApp‑propagating worm and a Delphi‑based banking trojan. When the victim clicks a worm link, it triggers an automated sequence that hijacks the WhatsApp session, downloads the MSI installer in the background, and deploys the stealer that scans for financial applications and crypto wallets.

“When it detects a match, for example, a window title or process name linked to Bradesco, BTG Pactual, Binance, Coinbase, MetaMask, Trust Wallet, or another financial brand, the malware immediately decrypts and activates its next-stage payload,” Spiderlabs researchers explained.

Another concerning trait of the campaign, besides its stealthy nature, is that the worm is able to access the victim’s contact list, which lets it target other potential victims.

Meanwhile, it prevents detection by using “hardcoded credentials to log into its email account,” which is retrieved from a Gmail inbox controlled by the operator. By using IMAP over SSL to fetch commands, a method that blends with ordinary user email traffic, the malware is able to bypass network filters and remain difficult to trace.

“It is a very clever way to update its C2, maintain persistence, and evade detections or takedowns on a network level. If the malware cannot connect to the email account, it uses a hardcoded fallback C2 address,” researchers added.

SpiderLabs researchers have urged Brazilian crypto users to remain alert, especially on WhatsApp, which has become a favored tool for social engineering-based malware campaigns.

“WhatsApp continues to be one of the most exploited communication channels in Brazil’s cybercrime ecosystem. Over the past two years, threat actors have refined their tactics, using the platform’s immense popularity to distribute banker trojans and information-stealing malware,” researchers warned.

Crypto adoption in Brazil has soared over the past few years, and with recent developments like potential plans to establish a national Bitcoin reserve and enforce a proper regulatory framework, the country has drawn increased attention from global investors and local users alike. On the Chainalysis Global Crypto Adoption Index, Brazil ranks fifth, while it stands as Latin America’s largest crypto market by volume.

As such, it remains a prime target for scammers and other bad actors seeking to exploit inexperienced users or take advantage of poorly protected systems.

Eternidade Stealer is a kind of infostealer, which, as mentioned above, can silently monitor applications, extract sensitive credentials, and activate fake overlays to harvest user data..

Back in September, security platform Mosyle uncovered one such cross-platform threat called ModStealer that remained undetected for weeks and was found to be targeting crypto wallets across macOS, Windows, and Linux environments. By using obfuscated JavaScript code within a Node.js environment, the malware was able to infiltrate developer systems and exfiltrate private keys and clipboard data from over 50 browser wallet extensions.

More recently, a Google Threat Intelligence Group report warned that bad actors have started using artificial intelligence to develop malware that can rewrite its own code in real time, making it a lot harder to detect or neutralize.

Source: https://crypto.news/brazilian-crypto-users-hit-by-whatsapp-malware-campaign-targeting-crypto-wallets/

Market Opportunity
Bad Idea AI Logo
Bad Idea AI Price(BAD)
$0.00000000094
$0.00000000094$0.00000000094
-3.09%
USD
Bad Idea AI (BAD) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Exploring Market Buzz: Unique Opportunities in Cryptocurrencies

Exploring Market Buzz: Unique Opportunities in Cryptocurrencies

In the ever-evolving world of cryptocurrencies, recent developments have sparked significant interest. A closer look at pricing forecasts for Cardano (ADA) and rumors surrounding a Solana (SOL) ETF, coupled with the emergence of a promising new entrant, Layer Brett, reveals a complex market dynamic. Cardano's Prospects: A Closer Look Cardano, a stalwart in the blockchain space, continues to hold its ground with its research-driven development strategy. The latest price predictions for ADA suggest potential gains, predicting a double or even quadruple increase in its valuation. Despite these optimistic forecasts, the allure of exponential gains drives traders toward more speculative ventures. The Buzz Around Solana ETF The potential introduction of a Solana ETF has the crypto community abuzz, potentially catapulting SOL prices to new heights. As investors await regulatory decisions, the impact of such an ETF on Solana's value could be substantial, potentially reaching up to $300. However, as with Cardano, the substantial market capitalization of Solana may temper its growth potential. Why Layer Brett is Gaining Traction Amidst established names, a new contender, Layer Brett, has started to capture the market's attention with its early presale stages. Offering a low entry price of just $0.0058 and promising over 700% in staking rewards, Layer Brett presents a tempting proposition for those looking to maximize returns. Comparative Analysis: ADA, SOL, and $LBRETT While both ADA and SOL offer stable investment choices with reliable growth, Layer Brett emerges as a high-risk, high-reward option that could potentially offer significantly higher returns due to its nascent market position and aggressive economic model. Initial presale pricing lets investors get in on the ground floor. Staking rewards currently exceed 690%, a persuasive incentive for early adopters. Backed by Ethereum's Layer 2 for enhanced transaction speed and reduced costs. A community-focused $1 million giveaway to further drive engagement and investor interest. Predicted by some analysts to offer up to 50x returns in coming years. Shifting Sands: Investor Movements As the crypto market landscape shifts, many investors, including those traditionally holding ADA and SOL, are beginning to diversify their portfolios by turning to high-potential opportunities like Layer Brett. The combination of strategic presale pricing and significant staking rewards is creating a momentum of its own. Act Fast: Time-Sensitive Opportunities As September progresses, opportunities to capitalize on these low entry points and high yield offerings from Layer Brett are likely to diminish. With increasing attention and funds being directed towards this new asset, the window to act is closing quickly. Invest in Layer Brett now to secure your position before the next price hike and staking rewards reduction. For more information, visit the Layer Brett website, join their Telegram group, or follow them on X by clicking the following links: Website Telegram X Disclaimer: This is a sponsored press release and is for informational purposes only. It does not reflect the views of Bitzo, nor is it intended to be used as legal, tax, investment, or financial advice.
Share
Coinstats2025/09/18 18:39
Tests 50-day EMA barrier near 183.00

Tests 50-day EMA barrier near 183.00

The post Tests 50-day EMA barrier near 183.00 appeared on BitcoinEthereumNews.com. EUR/JPY remains steady after three days of gains, trading around 182.70 during
Share
BitcoinEthereumNews2026/02/23 17:03
Moonshot MAGAX vs Shiba Inu: The AI-Powered Meme-to-Earn Revolution Challenging a Meme Coin Giant

Moonshot MAGAX vs Shiba Inu: The AI-Powered Meme-to-Earn Revolution Challenging a Meme Coin Giant

Discover how Moonshot MAGAX’s AI-powered meme-to-earn platform outpaces Shiba Inu with innovative tokenomics and growth potential in 2025.
Share
Blockchainreporter2025/09/18 03:15