WhatsApp 'Eternidade' Trojan Self-Propagates Through Brazil

A new Trojan called Eternidade is spreading through Brazil by worming its way across WhatsApp, with a focus on Brazilian Portuguese speakers. According to LevelBlue researchers, they found roughly 10,000 infected systems in the campaign, underscoring how targeted the infections have been.

The campaign comprises two halves: a worm that harvests a victim’s WhatsApp contacts and forwards the malware only to non-business contacts, and a Delphi-based Trojan that checks language and network context before loading a stealer payload. The dropper initially used PowerShell but newer variants are Python, a move that might reflect the authors’ multi-platform ambitions.

The stealer scans for banking and fintech sites, including Bank of Brazil and Santander, and can execute remote commands, exfiltrate data, and capture screenshots, with attackers able to adapt its C2 source by embedding credentials to access an attacker-controlled email domain. 20 November 2025