LevelBluePublished
SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp
By Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi
Excerpt
November 19, 2025 10 Minute Read by Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we dubbed Eternidade Stealer, which is distributed through WhatsApp hijacking and social engineering lures. In this blog post, we will break down the techniques used in the campaign and highlight the new tools employed by the threat group.
WhatsApp continues to be one of the most exploited communication channels in Brazil’s cybercrime ecosystem. Over the past two years, threat actors have refined their tactics, using the platform’s immens…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by LevelBlue on levelblue.com.
More from LevelBlue4
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
- CNCMahineRMSLevelBlue · Added 25 Aug
- Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal BrandLevelBlue · Published 4 Nov 2025
- LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese OrganizationsLevelBlue · Published 19 Jun 2024
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
