Brazilian cryptocurrency owners are advised to watch out for a sophisticated hacking effort that involves banking malware and a hijacking worm sent over WhatsApp messaging.
The banking trojan known as “Eternidade Stealer” is being distributed via social engineering on the messaging app WhatsApp, including “fake government programs, delivery notifications,” messages from friends, and fraudulent investment groups, according to a recent report from Trustwave’s cybersecurity research team, SpiderLabs.
The leaders quote
“WhatsApp continues to be one of the most exploited communication channels in Brazil’s cybercrime ecosystem. Over the past two years, threat actors have refined their tactics, using the platform’s immense popularity to distribute banker trojans and information-stealing malware,” said Spiderlabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi.
To put it simply, clicking the worm link in WhatsApp initiates a series of events that infect the user with both the banking trojan and the worm.
After taking over the account, the worm gains access to the victim’s contact list. For a more effective procedure, it uses “smart filtering” to target specific contacts while ignoring business contacts and groupings.
The Eternidade Stealer, which may search for financial information and logins to various Brazilian banks as well as fintech or cryptocurrency exchanges and wallets, is installed in the background by the banking trojan, which is a file that is automatically downloaded into the victim’s computer.
The malware update
Additionally, the virus has an ingenious method of avoiding detection or deactivation. It checks for new instructions via email using a pre-set Gmail account rather than a fixed server address. Sending fresh emails allows the hackers to modify commands.
“One notable feature of this malware is that it uses hardcoded credentials to log into its email account, from which it retrieves its C2 server. It is a very clever way to update its C2, maintain persistence, and evade detections or takedowns on a network level. If the malware cannot connect to the email account, it uses a hardcoded fallback C2 address,” the report reads.
Brazil and crypto
Brazil is the most cryptocurrency-adopting nation in Latin America, according to statistics from the cryptocurrency analytics platform Chainalysis. It is ranked fifth in the company’s 2025 Global Crypto Adoption Index Top 20.
The index considers population size and purchasing power in addition to the nations’ adoption of various cryptocurrency services.
To increase farm financing’s speed and transparency, Brazilian securitisation company VERT launched a private credit platform on the XRP Ledger. During the launch, an Agribusiness Receivables Certificate worth BRL 700 million was issued and recorded on-chain.
The Ministry of Justice and Public Security in Brazil has formally declared that it would purchase cutting-edge cryptocurrency tracking software. The step is intended to strengthen its capacity to keep an eye on and regulate transactions involving digital assets throughout the country.