Brazil Faces WhatsApp Malware Threat Targeting Crypto Wallets and Bank Accounts

A new WhatsApp worm is wreaking havoc in Brazil, compromising bank logins and cryptocurrency keys. Security firms report that victims receive seemingly innocuous messages—delivery notes, government alerts, or group invites—which, when clicked, allow the malware to spread through contacts while secretly extracting sensitive data.

The attack leverages ZIP files containing malicious .LNK shortcuts. These shortcuts execute deceptive commands, loading code directly into memory to evade detection by antivirus tools. The malware further propagates by hijacking WhatsApp Web sessions, sending malicious links to the victim's contacts, mimicking worm-like behavior.

Analysts have identified over 400 compromised customer environments and 1,000 infected endpoints, with one firm blocking 62,000 infection attempts in early October. Two primary strains are active: Eternidade Stealer, a banking trojan using Gmail as a command channel, and Maverick, which exploits automation tools like WPPConnect to disseminate malicious messages.