Heimdall Security Research at ISH Tecnologia has identified an advanced malware dissemination campaign via WhatsApp, called WhatsWorm. The threat uses Python automation to spread malicious files among contacts and install Eternidade Stealer, a banking trojan focused on stealing credentials and sensitive data. The attack combines multiple phases, obfuscation techniques, in-memory execution, use of Process Hollowing, and communication with C&C servers – a pattern increasingly present in campaigns targeting the Brazilian public.