Eternidade Stealer: New Python WhatsApp Worm Uses IMAP Email for Covert C2 and Brazilian Bank Overlays

Trustwave SpiderLabs researchers have identified a new banking Trojan called Eternidade Stealer, distributed as a WhatsApp-worm written in Python that hijacks WhatsApp, steals contact lists, and delivers banking overlays. The campaign uses an IMAP-based C2 retrieval mechanism, with hardcoded email credentials to fetch its C2 server and update its commands, and if inbox parsing fails it falls back to a hardcoded domain.

It begins with an obfuscated VBScript that drops a batch file which downloads a WhatsApp-propagating Python worm and a Delphi MSI installer, and the worm’s script is designed to automate messaging, steal data, and mass-distribute malware. The malware exfiltrates WhatsApp contacts via the wppconnect JavaScript APIs injected into WhatsApp Web, then sends the data to the C2 with no user interaction and no delay.

It targets Brazilian victims by language checks and includes overlays for several banks, such as Bradesco, Itaú, Santander, Caixa, and Banco do Brasil, alongside crypto and payment apps. The campaign also deploys a Delphi injector, a custom stream cipher, AutoIt loaders, and encrypted MSI payloads, forming a modular, actively developed family. The article, published on 24 November 2025, notes the global footprint alongside Brazil’s sophisticated cybercriminal ecosystem.