New Python-Based WhatsApp Worm Spreads Eternidade Stealer in Brazil

In this video, we delve into a recent cybersecurity incident involving a new Python-based worm that targets WhatsApp users in Brazil. Discovered on November 19, 2025, this malware campaign utilizes social engineering tactics and sophisticated techniques to spread the Eternidade Stealer, a Delphi-based banking trojan.

What you’ll learn: We will explore the mechanics of the Eternidade Stealer, the timeline of its deployment, the impact on Brazilian users, and what organizations and individuals can do to protect themselves from this emerging threat.

The Eternidade Stealer campaign represents a significant evolution in malware distribution methods, moving from PowerShell scripts to Python, which indicates a shift in the tactics employed by cybercriminals. The campaign exploits the widespread use of WhatsApp in Brazil, leveraging the messaging platform to propagate malicious attachments through a worm-like mechanism. This is not an isolated incident; it follows closely behind another campaign known as Water Saci, which also targeted Brazilian users with similar tactics.

The malware operates by hijacking WhatsApp accounts, sending malicious attachments to contacts, and using a combination of Visual Basic and Python scripts to execute its payloads. The Eternidade Stealer is designed to steal sensitive information, including banking credentials and cryptocurrency wallet details, by monitoring active windows and capturing keystrokes when users access financial applications.

The impact of this campaign is profound, affecting individuals and institutions across Brazil. Cybersecurity experts warn that the operational footprint of this malware could extend beyond Brazilian borders, posing a global threat. Users are advised to remain vigilant against suspicious WhatsApp activity and to be cautious about unexpected script executions.

Moving forward, cybersecurity defenders need to enhance their defenses against such threats. Organizations should implement robust security measures, including user education on recognizing phishing attempts and malware propagation tactics. It's crucial to monitor for indicators of compromise related to this ongoing campaign.

In conclusion, the emergence of the Eternidade Stealer underscores the need for continuous vigilance in the face of evolving cyber threats. Stay informed and proactive to protect your digital assets and personal information from these sophisticated attacks.