New Malware Via WhatsApp Exfiltrate Contacts to Attack Server and Deploys Malware

Trustwave SpiderLabs identified 'Eternidade Stealer', a sophisticated Delphi banking trojan distributed via obfuscated VBScript and WhatsApp hijacking that installs a Python-based WhatsApp worm and an MSI payload. The malware harvests WhatsApp contacts (filtering for personal contacts), exfiltrates them to C2, uses IMAP-based email retrieval for dynamic C2 updates, performs system reconnaissance, enforces a Brazilian Portuguese locale check, and deploys banking overlay screens to steal credentials from 40+ Brazilian financial services and exchanges—creating a high-risk targeted campaign with potential wider global activity.