WhatsApp Malware ‘Eternidade Stealer’ Targets Banks and Crypto Users in Brazil: Report

Highlights:

• Hackers use WhatsApp messages carrying a worm and banking trojan targeting crypto.
• The malware takes over accounts, collects contacts, and steals sensitive financial information.
• Experts advise checking links, updating devices, and using an antivirus to prevent infections.

Crypto users in Brazil are facing a growing threat. Hackers are targeting both cryptocurrency wallets and bank accounts using WhatsApp messages. These messages carry a hijacking worm and a banking trojan called “Eternidade Stealer,” according to a new report from Trustwave’s cybersecurity research team, SpiderLabs. Hackers trick people by sending messages that look like government programs, delivery updates, messages from friends, or fake investment groups. When someone clicks the link, their device gets infected, and hackers can steal their financial information.

Advertisement

🚨 A new WhatsApp worm is spreading fast in Brazil.

It hijacks chats, sends fake messages to all your contacts, and installs a program that steals bank and crypto logins.

… and it updates itself through an email inbox to stay hidden.

Read here ↓ https://t.co/YuJ9pgC8rg

— The Hacker News (@TheHackersNews) November 19, 2025

How This WhatsApp Worm Hijacks Accounts and Targets Financial Logins

“This is a very clever way to update its C2, maintain persistence, and evade detections or takedowns on a network level. If the malware cannot connect to the email account, it uses a hardcoded fallback C2 address,” the report reads. The worm automatically takes over a victim’s WhatsApp account and collects their contacts. It avoids business accounts and group chats and focuses only on individual contacts to spread more effectively.

Meanwhile, the banking trojan silently installs the Eternidade Stealer on the device, searching for logins to Brazilian banks, fintech apps, and crypto exchanges.

SpiderLabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi pointed out that WhatsApp has become one of the most used platforms for cybercrime in Brazil. They explained that in the past two years, hackers have improved their methods to spread banking trojans and other malware that steal information. The malware uses a Gmail account to receive commands from hackers. This lets them control devices remotely without fixed servers. Because of this, it is harder for authorities to stop the attacks quickly.

Experts say WhatsApp users should be careful with all links, even from friends. It is safer to check a link on another app before clicking. Updating devices and using antivirus software can help protect against malware. Hackers often use old software to break into devices, so simple updates are important.

Crypto Growth in Brazil Brings Regulatory Focus

Brazil is the biggest cryptocurrency market in Latin America. It ranks fifth in Chainalysis’ 2025 Global Crypto Adoption Index. The index looks at crypto use, population, and spending power, showing how big the risk can be. The country’s crypto market has grown fast. Stablecoins like USDT dominate most transactions.

According to federal tax authority data, crypto trades reached 227 billion reais ($42 billion) in the first half of 2025, up 20% from last year. Nearly two-thirds of this was USDT trading, while Bitcoin made up just 11%. Regulators say stablecoins are mostly used for payments, not investments.

Brazil is also planning to close a multi-billion-dollar loophole in its foreign exchange market. The Finance Ministry will apply the IOF tax (Financial Transaction Tax) to cross-border crypto transfers. This mainly targets stablecoins like USDT, which are often used to bypass regular FX taxes.

Exclusive: Brazil eyes taxing crypto for cross-border payments, sources say https://t.co/cP6nP88V57 https://t.co/cP6nP88V57

— Reuters (@Reuters) November 18, 2025

Advertisement