Brazil Issues Warning Over WhatsApp Malware Aiming Crypto-Targeting
Users of cryptocurrency in Brazil are being warned about a malware attack via WhatsApp that is causing quite a ruckus. According to Trustwave SpiderLabs cybersecurity researchers, they discovered a campaign using a hijacking worm in combination with the Eternidade Stealer banking trojan. It is designed to steal logins for banks, fintech apps, and crypto wallets.
As per SpiderLabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi, because WhatsApp is widely used it has become one of the platforms that give the most abuse in Brazil’s cybercrime underground. Scammers are using a messaging service to send believable traps disguised as government funds, delivery receipts, fake investment opportunities, and messages that appear to be sent by one’s contacts.
How the Crypto Malware Attack for WhatsApp Works
When a link sent via WhatsApp is clicked, the attack starts. This single tap triggers a chain infection that downloads a worm plus the Eternidade Stealer banking trojan.
The Worm
After infecting a person the worm hijacks that person’s WhatsApp account, scrapes all their personal contacts and auto-propagates. This avoids business accounts or big groups as these would be more challenging to prank than individual users.
The Banking Trojan
The downloaded trojan works quietly in the background. It aims to scan and steal financial credentials linked to banking apps, fintech platforms, crypto exchanges, and digital wallets of Brazilian users.
Also Read : Circle Calls for Fair Stablecoin Rules Amid GENIUS Act Implementation Debate
Trojan Program That Does Not Shut Down
One trait that stands out about the Eternidade Stealer campaign is its resilience. Rather than a standard server that authorities can pull offline, the malware connects to a predetermined Gmail account in order to receive instructions. Hackers remotely update commands simply by sending emails.
As reported by SpiderLabs, even if investigators cut access to the Gmail channel, the malware will be able to switch to its backup communication. Because of this flexibility, takedowns are almost impossible.
📈 Why Brazil? A Hotbed for Crypto Adoption
According to information from Chainalysis, Brazil, at 5th position in the 2025 Global Crypto Adoption Index of the firm, is the largest cryptocurrency market in Latin America. The hackers have a clear target to attack the growing number of crypto-savvy consumers, exchanges, and fintech platforms in the country.
🛡️ How to Stay Safe on WhatsApp as a Crypto User
To reduce the risk of falling victim to the malware:
- Avoid clicking on those unexpected links, even if your friend sent them.
- Check messages you suspect to be fraudulent on a different app or by calling the sender.
- Make sure your devices and apps are updated for security.
- Try a trusted antivirus software that can detect and remove it.
- If you are hacked, immediately lock your bank and crypto accounts.
Acting fast is critical. If exchanges and authorities freeze accounts and track stolen assets, they can block hackers’ wallets before the funds are lost forever.
🔎 Final Takeaway
Brazil’s crypto market is growing, and so is the cybercrime threat. If you are storing or trading digital assets, all you need now is awareness.
