According to Cointelegraph, Brazilian cryptocurrency holders are being cautioned about a sophisticated hacking campaign that employs a hijacking worm and banking trojan disseminated through WhatsApp messages. Trustwave’s cybersecurity research team, SpiderLabs, has identified the banking trojan, named 'Eternidade Stealer,' which is being spread via social engineering tactics on WhatsApp. These tactics include fake government programs, delivery notifications, messages from friends, and fraudulent investment groups.
SpiderLabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi noted that WhatsApp remains one of the most exploited communication channels in Brazil's cybercrime ecosystem. Over the past two years, cybercriminals have refined their strategies, leveraging the platform's widespread popularity to distribute banker trojans and information-stealing malware. The process begins when a user clicks on a worm link in WhatsApp, triggering a chain reaction that infects the device with both the worm and banking trojan.
The worm hijacks the victim's account and accesses their contact list, employing 'smart filtering' to bypass business contacts and groups, thereby targeting individual contacts more efficiently. Concurrently, the banking trojan automatically downloads onto the victim's device, deploying the Eternidade Stealer in the background. This malware scans for financial data and logins to various Brazilian banks, fintech companies, and crypto exchanges and wallets.
The malware employs a clever method to avoid detection or shutdown. Instead of using a fixed server address, it utilizes a pre-set Gmail account to receive new commands via email, allowing hackers to update commands by sending new emails. The report highlights that the malware uses hardcoded credentials to log into its email account, from which it retrieves its command and control (C2) server. This approach helps maintain persistence and evade network-level detections or takedowns. If the malware cannot connect to the email account, it resorts to a hardcoded fallback C2 address.
Users of apps like WhatsApp are advised to exercise caution with any links sent to them, even from trusted contacts. A prudent approach is to verify the link's legitimacy by messaging the sender on a different app. Additionally, users should be wary of links sent unexpectedly with limited context. Keeping software updated can protect against bugs targeting older versions, while antivirus software may help flag potential issues. In the event of a hack, it is crucial to immediately freeze all access points to banking and crypto services to prevent further damage. Tracking funds can assist exchanges, researchers, or authorities in tracing the assets' movement, potentially aiding in freezing hacker wallets.
Weatherly
