cybersecurity

🔥A dangerous new WhatsApp worm is exploding across Brazil — and it’s designed for one purpose:

💰 To steal your money.

Hackers are disguising malicious links inside everyday messages:

✔ Fake delivery updates

✔ Fake government programs

✔ Fake promotions

✔ Even messages that look like they came from your own friends

One tap is all it takes.

Once the link is opened, the worm silently hijacks your WhatsApp and begins spreading through your contact list. It avoids businesses and targets the people closest to you — making every message look trustworthy.

But the real danger is what happens in the background…

A banking trojan installs itself instantly and begins scanning your phone for:

🔐 Crypto wallets

🔐 Exchange logins

🔐 Banking apps

🔐 Fintech accounts popular in Brazil

It doesn’t wait. It digs through your data the moment it lands on your device.

What makes this attack even more frightening?

The malware doesn’t rely on a single command server.

Instead, it secretly checks a hidden Gmail account for new instructions. Hackers can update the attack just by sending an email — and if Gmail access fails, the malware shifts to a backup server to stay alive.

This worm is built to survive and adapt, even when networks attempt to shut it down.

Brazil is one of the world’s largest crypto markets… which makes it a perfect target for this kind of attack.

And here’s the truth:

If it’s happening there, it can easily spread worldwide next.

Stay alert.

Stay skeptical.

Stay protected.

Don’t wait until AFTER your data is gone to care about security — be smart BEFORE the damage is done.

#HackAlert #ScamAlert #WhatsAppHack #CyberSecurity #CryptoSafety

Cybersecurity researchers have uncovered a worrying new malware campaign exploiting WhatsApp hijacking and social engineering to push a dangerous banking trojan called Eternidade Stealer across Brazilian devices.
🔍 What’s happening?
A threat actor is spreading a WhatsApp worm built in Python — a shift from earlier PowerShell versions — allowing attackers to:
• Hijack a victim's WhatsApp Web session
• Harvest all contacts
• Auto-send malicious attachments to everyone in the list
• Spread the infection rapidly, like a chain reaction

💻 How the infection works:
The malware arrives via an obfuscated VBS script → drops two payloads:

1️⃣ Python script
Automates WhatsApp messaging using WPPConnectSteals contact detailsSends malware-laced attachments using time-based greetings
2️⃣ MSI installer
Deploys Eternidade StealerActivates only if the device uses Brazilian PortugueseProfiles system and security toolsInjects into svchost.exe for stealth
🧨 What Eternidade Stealer can do:
Once active, it monitors open windows for banking, crypto wallets, and payment platforms such as:
Bradesco, BTG Pactual, MercadoPago, Stripe, Binance, Coinbase, MetaMask, Trust Wallet, and more.

It can then:
✔ Record keystrokes
✔ Capture screenshots
✔ Steal credentials
✔ Take files
✔ Trigger credential overlays
✔ Communicate with C2 servers via IMAP-based dynamic addresses

🌍 Why this matters globally
Even though the malware targets Brazil, logs show connections from:
🇺🇸 US (196)
🇳🇱 Netherlands
🇩🇪 Germany
🇬🇧 UK
🇫🇷 France
…indicating wider exposure.

Researchers say the campaign resembles “Water Saci” but uses unique Python artifacts, likely created by a small team or even a single developer using AI tools.

🔐 Key takeaway:
This is another reminder that WhatsApp is becoming a high-risk propagation vector for malware.
Organizations should watch out for:
• Unexpected MSI or script executions
• Suspicious WhatsApp Web activity
• Unauthorized automation attempts
• Anomalous Python processes

🛡️ With messaging apps increasingly abused for malware delivery, do you think enterprises should start restricting or monitoring WhatsApp Web on company devices?
$BTC

#CyberSecurity #BTCVolatility #USJobsData #USStocksForecast2026 #USStocksForecast2026

Satoshi Nakamoto 的 1.1 百万比特币宝藏，价值数十亿美元，通常被视为一个“幽灵船”数字资产，静静地沉睡在区块链上。但对于密码学界来说，它不仅仅是一个传说，还是一个巨大的安全风险。
威胁不是来自普通黑客，而是来自一个全新的计算力量：量子计算机。
📜 第 1 部分 - 背景：Satoshi 钱包的“原始”漏洞

安全公司Socket揭露了一款伪装成“Safery:以太坊钱包”的恶意Chrome扩展程序。
这款恶意扩展程序秘密将用户的种子短语编码成Sui微交易，使攻击者能够在不被发现的情况下盗取钱包。同时，澳大利亚当局警告称，罪犯冒充警察，利用官方政府系统施压受害者转移他们的数字资产。这些案例共同揭示了诈骗者如何将技术后门与社交工程策略相结合，欺骗甚至是谨慎的用户。加密用户被诅咒，以极大的怀疑态度对待意外的通信。