Trend exposed the Water Saci worm, a self-propagating campaign that hijacks WhatsApp Web using Selenium/PowerShell. It uses a stealthy IMAP email C2 channel with HTTP fallback.

BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.

Zimperium found 760+ Android apps exploiting NFC/HCE to steal payment data. The malware impersonates 20 banks across Russia, Poland, and Brazil, using Telegram for criminal coordination.

The Maverick banking trojan (linked to Coyote) is spreading via WhatsApp Web, hijacking accounts using the SORVEPOTEL module to target Brazilian users' contacts.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Trustwave exposed Eternidade Stealer, a sophisticated Brazilian Trojan. The Python WhatsApp worm steals contact lists and uses IMAP email for covert C2 retrieval to launch banking overlays.

RelayNFC is a new, zero-detection Android malware targeting Brazil that turns the victim's phone into a remote card reader to steal data and complete real-time contactless payments.

Trend Micro exposed Water Saci, a campaign using LLMs to convert malware from PowerShell to Python, accelerating its spread via a WhatsApp worm. The multi-stage attack deploys a trojan capable of VNC mirroring and overlay attacks.

After the European Union forced iOS to “open up” under the Digital Markets Act (DMA), Brazil has now notched a major win of its own. Brazil’s Administrative Council for Economic Defense (CADE) rec…