The WhatsWorm campaign represents a significant threat stemming from Brazilian threat actors who have exploited the popular instant messaging application WhatsApp to propagate malware. The campaign initiates with a malicious Visual Basic Script (.vbs) embedded within a ZIP file, disseminated via phishing messages to victims. This script is the starting point of the infection chain, enabling further stages of malware execution. The third phase of the campaign involves the execution of a compiled AutolT interpreter, identified as jFqyDSPp.exe, which is designed to carry out a series of functions. It executes a script from an accompanying log file that operates as a Banking Information Stealer and orchestrates the loading of the subsequent fourth stage, known as Eternity Stealer. The AutolT script utilizes Reflective DLL Injection to execute the payload in memory, thereby evading detection systems typically employed in endpoint protection.