Eternidade Stealer: WhatsApp Hijacking for Banking Fraud
Trustwave SpiderLabs researchers have identified a banking Trojan dubbed Eternidade Stealer, distributed through WhatsApp hijacking and social engineering lures. The campaign uses a WhatsApp worm written in Python to spread malicious attachments and an MSI installer that deploys a Delphi-based banking trojan. The malware uses Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses and targets Brazilian victims by checking the OS language. It scans for strings associated with banking portals, payment services, and cryptocurrency platforms, and activates its next-stage payload when a match is found. The malware also uses hardcoded credentials to log into its email account and retrieve its C2 server, allowing it to update its C2, maintain persistence, and evade detections or takedowns.