MalwarePublished 19 Nov 2025

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Source Reddit InfoSec News

Description

A Python-based worm propagates through WhatsApp, spreading the Eternidade stealer malware primarily targeting Brazilian devices. This malware harvests sensitive information from infected systems, leveraging social engineering via WhatsApp to self-replicate and infect new victims. Although currently focused on Brazil, the worm's propagation method and malware payload pose risks to any WhatsApp users, including European organizations with employees or contacts linked to Brazil. The worm does not require complex exploits but relies on user interaction to propagate. There is no known CVSS score, but the threat is assessed as high severity due to its potential impact on confidentiality and ease of spread. Defenders should focus on user awareness, endpoint detection, and network monitoring to mitigate infection risks. Countries with strong economic or cultural ties to Brazil and high WhatsApp usage are more likely to be affected in Europe.

Impact

For European organizations, the primary impact is the risk of data theft and potential lateral movement if employees communicate with Brazilian contacts via WhatsApp. Compromised devices could lead to credential theft, exposing corporate accounts and sensitive information. The worm’s social engineering vector means that even well-secured networks could be at risk if endpoint security and user awareness are insufficient. The spread through WhatsApp, a widely used communication tool, increases the risk of infection across organizational boundaries, potentially affecting supply chains or partners connected to Brazil. Data breaches resulting from the Eternidade stealer could lead to financial loss, reputational damage, and regulatory penalties under GDPR if personal data is compromised. The threat also highlights the risk of cross-border malware propagation via popular messaging platforms, necessitating vigilance in multinational environments. While currently focused on Brazil, the worm’s propagation method could enable it to reach European users, especially in countries with strong business or diaspora links to Brazil.

Defensive guidance

European organizations should implement targeted user awareness campaigns emphasizing the risks of clicking unsolicited links or files received via WhatsApp, especially from contacts that may have been compromised. Endpoint detection and response (EDR) solutions should be configured to detect and block known indicators of compromise related to the Eternidade stealer and suspicious Python-based executables. Network monitoring should include analysis of WhatsApp traffic patterns where feasible, looking for anomalous behavior such as mass messaging or unusual file transfers. Organizations should enforce strict device hygiene policies, including regular patching, restricting execution of unauthorized scripts or binaries, and using application whitelisting. Multi-factor authentication (MFA) should be enforced on all critical systems to mitigate credential theft impact. Incident response plans should be updated to include scenarios involving social engineering-based malware spread via messaging apps. Collaboration with local cybersecurity authorities and information sharing with partners in Brazil can provide early warnings and threat intelligence updates. Finally, consider restricting or monitoring the use of WhatsApp on corporate devices if risk assessments justify it.

Summary

The threat involves a Python-based worm that spreads via WhatsApp messages, primarily targeting devices in Brazil. This worm delivers the Eternidade stealer, a malware designed to exfiltrate sensitive data such as credentials, financial information, and possibly other personal data from infected devices. The worm propagates by sending malicious links or files through WhatsApp chats, exploiting the trust users place in their contacts to induce them to execute the payload. The use of Python suggests cross-platform capabilities, potentially affecting Windows, Linux, or macOS systems where Python runtime is available or bundled. The worm’s propagation mechanism relies heavily on social engineering rather than exploiting technical vulnerabilities, requiring user interaction to click links or open files. Although no specific affected software versions or CVEs are listed, the malware’s impact is significant due to its data-stealing capabilities and rapid spread through a widely used communication platform. The lack of known exploits in the wild for software vulnerabilities indicates the threat vector is primarily social engineering combined with malware delivery. The worm’s targeting of Brazilian devices aligns with the high WhatsApp penetration in Brazil, but the threat could extend to other regions with WhatsApp users connected to Brazilian contacts. The technical details are limited, but the high severity rating reflects the malware’s potential to compromise confidentiality and the ease with which it spreads.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Nov 2025, 18:56 UTC

Technical details

References

Community reviews

Related threats