Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Eternidade Stealer WhatsApp-propagating banking Trojan

Malware Activity
First reported
Last updated
Happening score
H score 30
2 unique sources, 2 articles

Summary

Hide ▲

Eternidade Stealer is a WhatsApp-propagating banking trojan targeting users in Brazil. The campaign combines an obfuscated Visual Basic Script, a Python WhatsApp worm, and an MSI/AutoIt dropper that injects the stealer into svchost.exe using process hollowing. The malware uses IMAP and a terra.com[.]br mailbox to refresh C2 details, and it can steal keystrokes, capture screenshots, and exfiltrate files.

Related Happenings

CrashStealer macOS information stealer activity

Malware Activity
H score10 First: 13.07.2026 20:36 Last: 13.07.2026 20:36 Sources 1

About this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...

Open Happening

QuimaRAT cross-platform Java MaaS remote access trojan

Malware Activity
H score29 First: 06.07.2026 11:13 Last: 06.07.2026 11:13 Sources 1

About this happening: A new QuimaRAT MaaS offering expands cross-platform malware risk by packaging a modular Java-based RAT for Windows, Linux, and macOS. The activity matters because...

Open Happening

MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage

Technical Analysis
H score23 First: 24.06.2026 17:00 Last: 24.06.2026 17:00 Sources 1

About this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...

Open Happening

WhatsApp VBScript infection chain installing ManageEngine RMM Central

Malware Activity
H score20 First: 23.06.2026 08:38 Last: 23.06.2026 08:38 Sources 1

About this happening: VBScript attachments spread through WhatsApp direct messages are now driving a multi-stage Windows infection chain that can end in remote access to victim systems. The...

Open Happening

WhatsApp VBScript phishing campaign targeting users in multiple countries

Campaign
H score43 First: 23.06.2026 01:42 Last: 23.06.2026 01:42 Sources 1

About this happening: An ongoing phishing campaign is using compromised WhatsApp accounts to send obfuscated VBScript files to users in multiple countries, creating a path to remote s...

Open Happening

Timeline

  1. 19.11.2025 17:00 3 articles · 7mo ago

    Trustwave SpiderLabs identifies Eternidade Stealer WhatsApp-propagating banking Trojan

    Initial Disclosure

    Trustwave SpiderLabs identifies Eternidade Stealer as a newly observed banking Trojan affecting Brazil’s cybercrime ecosystem, using WhatsApp as both an entry point and a propagation channel. The malware combines a Python-written WhatsApp worm, a Delphi-based stealer and an MSI dropper to harvest financial data, system details and contact lists, while also using hard-coded email credentials to retrieve fresh C2 details from an IMAP mailbox. It targets Brazilian Portuguese systems, checks for banking, fintech and cryptocurrency applications, and focuses on desktop environments, with backend logs showing 454 connection attempts from 38 countries.

    Show sources
    Open in new tab