Brazil Hit by Banking Trojan Spread via WhatsApp Worm and RelayNFC NFC Relay Fraud

The Hacker News reports that Brazil is seeing a new wave of a banking Trojan spread by a WhatsApp worm and related NFC-relay fraud efforts, with attackers using HTML Application (HTA) files and PDFs to propagate the worm. The threat actor known as Water Saci is actively evolving its infection chain, shifting from PowerShell to a Python-based variant that spreads via WhatsApp Web, in attacks targeting Brazilian users.

According to Trend Micro, the campaign features a multi-format attack chain and AI-assisted porting of scripts, enabling faster, more resilient delivery across channels and broader browser compatibility. In these attacks, victims receive messages from trusted contacts urging interaction with malicious attachments, and the MSI installer, AutoIt-based loader, and a marker file named executed.dat are used to drop the banking trojan and ensure persistence.

The report also notes a second effort, RelayNFC, an Android malware campaign designed to siphon contactless payment data through NFC relay attacks, using phishing sites and real-time APDU relaying over WebSockets.