The post Brazilian crypto users hit by WhatsApp malware campaign targeting crypto wallets appeared on BitcoinEthereumNews.com. Bad actors are weaponizing WhatsApp to deliver a hijacking worm and banking trojan in Brazil that targets their crypto wallets. Summary SpiderLabs has warned about a WhatsApp‑based malware campaign in Brazil that deploys a worm and banking trojan to target crypto users. The malware is able to harvest sensitive information related to the victim’s crypto exchange account and wallets. Trustwave’s cybersecurity research team SpiderLabs has uncovered a major campaign involving the Eternidade Stealer, which can quietly harvest financial information, login data, and other sensitive details associated with banking portals, fintech apps, and crypto exchanges on the victim’s device. Threat actors were found to be using complex social engineering schemes involving “fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups,” the report said. Attackers are using a two‑stage process to deliver the malicious payload that includes a WhatsApp‑propagating worm and a Delphi‑based banking trojan. When the victim clicks a worm link, it triggers an automated sequence that hijacks the WhatsApp session, downloads the MSI installer in the background, and deploys the stealer that scans for financial applications and crypto wallets. “When it detects a match, for example, a window title or process name linked to Bradesco, BTG Pactual, Binance, Coinbase, MetaMask, Trust Wallet, or another financial brand, the malware immediately decrypts and activates its next-stage payload,” Spiderlabs researchers explained. Another concerning trait of the campaign, besides its stealthy nature, is that the worm is able to access the victim’s contact list, which lets it target other potential victims. Meanwhile, it prevents detection by using “hardcoded credentials to log into its email account,” which is retrieved from a Gmail inbox controlled by the operator. By using IMAP over SSL to fetch commands, a method that blends with ordinary user email traffic, the malware is able… The post Brazilian crypto users hit by WhatsApp malware campaign targeting crypto wallets appeared on BitcoinEthereumNews.com. Bad actors are weaponizing WhatsApp to deliver a hijacking worm and banking trojan in Brazil that targets their crypto wallets. Summary SpiderLabs has warned about a WhatsApp‑based malware campaign in Brazil that deploys a worm and banking trojan to target crypto users. The malware is able to harvest sensitive information related to the victim’s crypto exchange account and wallets. Trustwave’s cybersecurity research team SpiderLabs has uncovered a major campaign involving the Eternidade Stealer, which can quietly harvest financial information, login data, and other sensitive details associated with banking portals, fintech apps, and crypto exchanges on the victim’s device. Threat actors were found to be using complex social engineering schemes involving “fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups,” the report said. Attackers are using a two‑stage process to deliver the malicious payload that includes a WhatsApp‑propagating worm and a Delphi‑based banking trojan. When the victim clicks a worm link, it triggers an automated sequence that hijacks the WhatsApp session, downloads the MSI installer in the background, and deploys the stealer that scans for financial applications and crypto wallets. “When it detects a match, for example, a window title or process name linked to Bradesco, BTG Pactual, Binance, Coinbase, MetaMask, Trust Wallet, or another financial brand, the malware immediately decrypts and activates its next-stage payload,” Spiderlabs researchers explained. Another concerning trait of the campaign, besides its stealthy nature, is that the worm is able to access the victim’s contact list, which lets it target other potential victims. Meanwhile, it prevents detection by using “hardcoded credentials to log into its email account,” which is retrieved from a Gmail inbox controlled by the operator. By using IMAP over SSL to fetch commands, a method that blends with ordinary user email traffic, the malware is able…

Brazilian crypto users hit by WhatsApp malware campaign targeting crypto wallets

Bad actors are weaponizing WhatsApp to deliver a hijacking worm and banking trojan in Brazil that targets their crypto wallets.

Summary

  • SpiderLabs has warned about a WhatsApp‑based malware campaign in Brazil that deploys a worm and banking trojan to target crypto users.
  • The malware is able to harvest sensitive information related to the victim’s crypto exchange account and wallets.

Trustwave’s cybersecurity research team SpiderLabs has uncovered a major campaign involving the Eternidade Stealer, which can quietly harvest financial information, login data, and other sensitive details associated with banking portals, fintech apps, and crypto exchanges on the victim’s device.

Threat actors were found to be using complex social engineering schemes involving “fake government programs, delivery notifications, and even fraudulent investment groups shared through WhatsApp messages and groups,” the report said.

Attackers are using a two‑stage process to deliver the malicious payload that includes a WhatsApp‑propagating worm and a Delphi‑based banking trojan. When the victim clicks a worm link, it triggers an automated sequence that hijacks the WhatsApp session, downloads the MSI installer in the background, and deploys the stealer that scans for financial applications and crypto wallets.

“When it detects a match, for example, a window title or process name linked to Bradesco, BTG Pactual, Binance, Coinbase, MetaMask, Trust Wallet, or another financial brand, the malware immediately decrypts and activates its next-stage payload,” Spiderlabs researchers explained.

Another concerning trait of the campaign, besides its stealthy nature, is that the worm is able to access the victim’s contact list, which lets it target other potential victims.

Meanwhile, it prevents detection by using “hardcoded credentials to log into its email account,” which is retrieved from a Gmail inbox controlled by the operator. By using IMAP over SSL to fetch commands, a method that blends with ordinary user email traffic, the malware is able to bypass network filters and remain difficult to trace.

“It is a very clever way to update its C2, maintain persistence, and evade detections or takedowns on a network level. If the malware cannot connect to the email account, it uses a hardcoded fallback C2 address,” researchers added.

SpiderLabs researchers have urged Brazilian crypto users to remain alert, especially on WhatsApp, which has become a favored tool for social engineering-based malware campaigns.

“WhatsApp continues to be one of the most exploited communication channels in Brazil’s cybercrime ecosystem. Over the past two years, threat actors have refined their tactics, using the platform’s immense popularity to distribute banker trojans and information-stealing malware,” researchers warned.

Crypto adoption in Brazil has soared over the past few years, and with recent developments like potential plans to establish a national Bitcoin reserve and enforce a proper regulatory framework, the country has drawn increased attention from global investors and local users alike. On the Chainalysis Global Crypto Adoption Index, Brazil ranks fifth, while it stands as Latin America’s largest crypto market by volume.

As such, it remains a prime target for scammers and other bad actors seeking to exploit inexperienced users or take advantage of poorly protected systems.

Eternidade Stealer is a kind of infostealer, which, as mentioned above, can silently monitor applications, extract sensitive credentials, and activate fake overlays to harvest user data..

Back in September, security platform Mosyle uncovered one such cross-platform threat called ModStealer that remained undetected for weeks and was found to be targeting crypto wallets across macOS, Windows, and Linux environments. By using obfuscated JavaScript code within a Node.js environment, the malware was able to infiltrate developer systems and exfiltrate private keys and clipboard data from over 50 browser wallet extensions.

More recently, a Google Threat Intelligence Group report warned that bad actors have started using artificial intelligence to develop malware that can rewrite its own code in real time, making it a lot harder to detect or neutralize.

Source: https://crypto.news/brazilian-crypto-users-hit-by-whatsapp-malware-campaign-targeting-crypto-wallets/

Market Opportunity
Bad Idea AI Logo
Bad Idea AI Price(BAD)
$0.00000000108
$0.00000000108$0.00000000108
-3.57%
USD
Bad Idea AI (BAD) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Republic Europe Offers Indirect Kraken Stake via SPV

Republic Europe Offers Indirect Kraken Stake via SPV

Republic Europe launches SPV for European retail access to Kraken equity pre-IPO.
Share
bitcoininfonews2026/01/30 13:32
cpwrt Limited Positions Customer Support as a Strategic Growth Function

cpwrt Limited Positions Customer Support as a Strategic Growth Function

For many growing businesses, customer support is often viewed as a cost center rather than a strategic function. cpwrt limited challenges this perception by providing
Share
Techbullion2026/01/30 13:07
Unlocking Massive Value: Curve Finance Revenue Sharing Proposal for CRV Holders

Unlocking Massive Value: Curve Finance Revenue Sharing Proposal for CRV Holders

BitcoinWorld Unlocking Massive Value: Curve Finance Revenue Sharing Proposal for CRV Holders The dynamic world of decentralized finance (DeFi) is constantly evolving, bringing forth new opportunities and innovations. A significant development is currently unfolding at Curve Finance, a leading decentralized exchange (DEX). Its founder, Michael Egorov, has put forth an exciting proposal designed to offer a more direct path for token holders to earn revenue. This initiative, centered around a new Curve Finance revenue sharing model, aims to bolster the value for those actively participating in the protocol’s governance. What is the “Yield Basis” Proposal and How Does it Work? At the core of this forward-thinking initiative is a new protocol dubbed Yield Basis. Michael Egorov introduced this concept on the CurveDAO governance forum, outlining a mechanism to distribute sustainable profits directly to CRV holders. Specifically, it targets those who stake their CRV tokens to gain veCRV, which are essential for governance participation within the Curve ecosystem. Let’s break down the initial steps of this innovative proposal: crvUSD Issuance: Before the Yield Basis protocol goes live, $60 million in crvUSD will be issued. Strategic Fund Allocation: The funds generated from the sale of these crvUSD tokens will be strategically deployed into three distinct Bitcoin-based liquidity pools: WBTC, cbBTC, and tBTC. Pool Capping: To ensure balanced risk and diversified exposure, each of these pools will be capped at $10 million. This carefully designed structure aims to establish a robust and consistent income stream, forming the bedrock of a sustainable Curve Finance revenue sharing mechanism. Why is This Curve Finance Revenue Sharing Significant for CRV Holders? This proposal marks a pivotal moment for CRV holders, particularly those dedicated to the long-term health and governance of Curve Finance. Historically, generating revenue for token holders in the DeFi space can often be complex. The Yield Basis proposal simplifies this by offering a more direct and transparent pathway to earnings. By staking CRV for veCRV, holders are not merely engaging in governance; they are now directly positioned to benefit from the protocol’s overall success. The significance of this development is multifaceted: Direct Profit Distribution: veCRV holders are set to receive a substantial share of the profits generated by the Yield Basis protocol. Incentivized Governance: This direct financial incentive encourages more users to stake their CRV, which in turn strengthens the protocol’s decentralized governance structure. Enhanced Value Proposition: The promise of sustainable revenue sharing could significantly boost the inherent value of holding and staking CRV tokens. Ultimately, this move underscores Curve Finance’s dedication to rewarding its committed community and ensuring the long-term vitality of its ecosystem through effective Curve Finance revenue sharing. Understanding the Mechanics: Profit Distribution and Ecosystem Support The distribution model for Yield Basis has been thoughtfully crafted to strike a balance between rewarding veCRV holders and supporting the wider Curve ecosystem. Under the terms of the proposal, a substantial portion of the value generated by Yield Basis will flow back to those who contribute to the protocol’s governance. Returns for veCRV Holders: A significant share, specifically between 35% and 65% of the value generated by Yield Basis, will be distributed to veCRV holders. This flexible range allows for dynamic adjustments based on market conditions and the protocol’s performance. Ecosystem Reserve: Crucially, 25% of the Yield Basis tokens will be reserved exclusively for the Curve ecosystem. This allocation can be utilized for various strategic purposes, such as funding ongoing development, issuing grants, or further incentivizing liquidity providers. This ensures the continuous growth and innovation of the platform. The proposal is currently undergoing a democratic vote on the CurveDAO governance forum, giving the community a direct voice in shaping the future of Curve Finance revenue sharing. The voting period is scheduled to conclude on September 24th. What’s Next for Curve Finance and CRV Holders? The proposed Yield Basis protocol represents a pioneering approach to sustainable revenue generation and community incentivization within the DeFi landscape. If approved by the community, this Curve Finance revenue sharing model has the potential to establish a new benchmark for how decentralized exchanges reward their most dedicated participants. It aims to foster a more robust and engaged community by directly linking governance participation with tangible financial benefits. This strategic move by Michael Egorov and the Curve Finance team highlights a strong commitment to innovation and strengthening the decentralized nature of the protocol. For CRV holders, a thorough understanding of this proposal is crucial for making informed decisions regarding their staking strategies and overall engagement with one of DeFi’s foundational platforms. FAQs about Curve Finance Revenue Sharing Q1: What is the main goal of the Yield Basis proposal? A1: The primary goal is to establish a more direct and sustainable way for CRV token holders who stake their tokens (receiving veCRV) to earn revenue from the Curve Finance protocol. Q2: How will funds be generated for the Yield Basis protocol? A2: Initially, $60 million in crvUSD will be issued and sold. The funds from this sale will then be allocated to three Bitcoin-based pools (WBTC, cbBTC, and tBTC), with each pool capped at $10 million, to generate profits. Q3: Who benefits from the Yield Basis revenue sharing? A3: The proposal states that between 35% and 65% of the value generated by Yield Basis will be returned to veCRV holders, who are CRV stakers participating in governance. Q4: What is the purpose of the 25% reserve for the Curve ecosystem? A4: This 25% reserve of Yield Basis tokens is intended to support the broader Curve ecosystem, potentially funding development, grants, or other initiatives that contribute to the platform’s growth and sustainability. Q5: When is the vote on the Yield Basis proposal? A5: A vote on the proposal is currently underway on the CurveDAO governance forum and is scheduled to run until September 24th. If you found this article insightful and valuable, please consider sharing it with your friends, colleagues, and followers on social media! Your support helps us continue to deliver important DeFi insights and analysis to a wider audience. To learn more about the latest DeFi market trends, explore our article on key developments shaping decentralized finance institutional adoption. This post Unlocking Massive Value: Curve Finance Revenue Sharing Proposal for CRV Holders first appeared on BitcoinWorld.
Share
Coinstats2025/09/18 00:35