Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have revealed a new campaign that uses social engineering and hijacked WhatsApp accounts to spread a Delphi-based banking trojan named Eternidade Stealer, primarily targeting Brazilian users. The campaign uses IMAP to dynamically retrieve C2 addresses, enabling the threat actor to update its control server, according to Trustwave SpiderLabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi in a technical breakdown shared with The Hacker News.

It distributes Eternidade via a WhatsApp worm that now uses a Python script rather than PowerShell, and leverages the open-source WPPConnect project to automate message sending from hijacked accounts to victims’ contacts. The infection chain drops two payloads: a Python-based component that disseminates the worm through WhatsApp Web, and an MSI installer that deploys the Eternidade Stealer, including an AutoIt script that checks if the system language is Brazilian Portuguese and terminates if not.

Once active, the Delphi-based credential stealer scans for banking and wallet-related windows and exfiltrates data to a C2 server, with further commands enabling keystroke logging, screenshots, and file theft.