Brazilian Banking Trojan Uses Python WhatsApp Worm and IMAP C2 for In-Memory Credential Theft

A new phishing and malware operation in Brazil is exploiting WhatsApp Web session hijacking and an advanced in-memory banking trojan, as reported by K7 Labs. The campaign, linked to Water-Saci operations, starts with a phishing email containing a malicious ZIP file that executes a VBS script. This script downloads a Python-based WhatsApp spam bot that steals session artifacts and sends malware to victims' contacts.

The attack also involves an AutoIt loader that monitors for banking applications and injects a banking trojan into memory to steal credentials from major Brazilian banks. The trojan uses covert email-based communication to transmit stolen data, evading detection.