A new WhatsApp-propagating worm is infecting devices in Brazil, delivering a banking trojan called Eternidade (Portuguese for Eternity) Stealer that steals credentials for cryptocurrency wallets and financial services. According to the findings of Web3 security firm Trustwave SpiderLabs researchers Nathaniel Morales, John Basmayor and Nikita Kazymirskyi, the operation uses Internet Message Access Protocol to fetch […]A new WhatsApp-propagating worm is infecting devices in Brazil, delivering a banking trojan called Eternidade (Portuguese for Eternity) Stealer that steals credentials for cryptocurrency wallets and financial services. According to the findings of Web3 security firm Trustwave SpiderLabs researchers Nathaniel Morales, John Basmayor and Nikita Kazymirskyi, the operation uses Internet Message Access Protocol to fetch […]

WhatsApp worm spreads Python-based banking and crypto credential-stealing trojan in Brazil

2025/11/20 21:02
4 min read
For feedback or concerns regarding this content, please contact us at [email protected]

A new WhatsApp-propagating worm is infecting devices in Brazil, delivering a banking trojan called Eternidade (Portuguese for Eternity) Stealer that steals credentials for cryptocurrency wallets and financial services.

According to the findings of Web3 security firm Trustwave SpiderLabs researchers Nathaniel Morales, John Basmayor and Nikita Kazymirskyi, the operation uses Internet Message Access Protocol to fetch command-and-control details on demand. The stolen data can help a threat actor to rotate servers and evade disruption as the malware spreads.

“It uses Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses, allowing the threat actor to update its C2 server,” the security professionals wrote in the company’s blog page on Wednesday.

Investigators said the attackers abandoned older PowerShell scripts and are now deploying a Python-based approach to hijack WhatsApp and distribute malicious files. 

Eternidade stealer hides activity through VBScript

Per Trustwave SpiderLabs’ report, the attack begins with an obfuscated VBScript whose comments are mostly written in Portuguese.

The Python worm uses shorter, more agile code to automate WhatsApp activity to extract full contact lists using wppconnect libraries, customized greetings based on the time of day, and insert recipients’ names into messages containing malicious attachments.

A central function, named “obter_contatos,” enables the malware to steal the victim’s entire WhatsApp address book. For each contact, the worm collects the phone number and name to find out if the person is saved locally and has a device that can be breached. 

The data is transmitted to an attacker-controlled server through an HTTP POST request, where after collection, a worm sends a malicious attachment to every contact using a prebuilt message template.

MSI installer deploys localized banking trojan

The second stage of the attack starts once the MSI installer drops several components, including an AutoIt script that immediately checks if the device language is set to Brazilian Portuguese. 

In cases where the system does not meet this condition, the malware shuts down, which could mean the threat actors intend to target only users in Brazil.

When the locale check passes, the script scans running processes and registry keys for signs of security tools. It also profiles the device and sends system details back to the attackers’ command-and-control server.

The attack ends with the malware injecting the Eternidade Stealer payload into “svchost.exe” using a process that hides malicious code within legitimate Windows processes, known as “hollowing.”

Eternidade Stealer continuously monitors active windows and processes for strings related to financial services, including some of Brazil’s largest banks and international fintech platforms. 

Some of the financial firms mentioned by Trustwave include Santander, Banco do Brasil, BMG, Sicredi, Bradesco, BTG Pactual, MercadoPago, Stripe, alongside crypto companies Binance, Coinbase, MetaMask, and Trust Wallet.

Brazilian banking trojans are mostly dormant until the victim opens one of the financial applications. It then triggers overlays or credential-harvesting routines while completely invisible to casual users or automated security analysis tools.

Malware geofencing limits attacks to Brazilian WhatsApp users 

Trustwave SpiderLabs also shared panel stats, which revealed that the malware restricts access to systems outside Brazil and Argentina. Out of 454 recorded communication attempts, 452 were blocked due to geofencing rules. Only two connections were allowed and redirected to the real malicious domain, and blocked attempts were rerouted to a placeholder error page.

WhatsApp worm spreads trojan targeting Brazilian crypto apps, financial credentialsOperating system distribution across observed panel data. Source: Trustwave

Of the failed connection attempts, 196 came from the United States, followed by the Netherlands, Germany, the UK, and France. Windows accounted for the largest share of attempted system connections with 115, though logs also included 94 connections on macOS, 45 on Linux, and 18 Android devices.

The discovery comes weeks after Trustwave found another operation dubbed “Water Saci” spreading through WhatsApp Web using a worm called SORVEPOTEL. That malware is a conduit for Maverick, a NET-based banking trojan that came from an earlier family known as Coyote, as Cryptopolitan reported last week.

Get $50 free to trade crypto when you sign up to Bybit now

Market Opportunity
John Tsubasa Rivals Logo
John Tsubasa Rivals Price(JOHN)
$0.00123
$0.00123$0.00123
-4.65%
USD
John Tsubasa Rivals (JOHN) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact [email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Trump-backed WLFI  launches AgentPay SDK open-source payment toolkit for AI agents

Trump-backed WLFI  launches AgentPay SDK open-source payment toolkit for AI agents

The Trump family has expanded its presence in the crypto community with a major development for artificial intelligence (AI) agents. According to reports, World
Share
Cryptopolitan2026/03/20 19:03
Summarize Any Stock’s Earnings Call in Seconds Using FMP API

Summarize Any Stock’s Earnings Call in Seconds Using FMP API

Turn lengthy earnings call transcripts into one-page insights using the Financial Modeling Prep APIPhoto by Bich Tran Earnings calls are packed with insights. They tell you how a company performed, what management expects in the future, and what analysts are worried about. The challenge is that these transcripts often stretch across dozens of pages, making it tough to separate the key takeaways from the noise. With the right tools, you don’t need to spend hours reading every line. By combining the Financial Modeling Prep (FMP) API with Groq’s lightning-fast LLMs, you can transform any earnings call into a concise summary in seconds. The FMP API provides reliable access to complete transcripts, while Groq handles the heavy lifting of distilling them into clear, actionable highlights. In this article, we’ll build a Python workflow that brings these two together. You’ll see how to fetch transcripts for any stock, prepare the text, and instantly generate a one-page summary. Whether you’re tracking Apple, NVIDIA, or your favorite growth stock, the process works the same — fast, accurate, and ready whenever you are. Fetching Earnings Transcripts with FMP API The first step is to pull the raw transcript data. FMP makes this simple with dedicated endpoints for earnings calls. If you want the latest transcripts across the market, you can use the stable endpoint /stable/earning-call-transcript-latest. For a specific stock, the v3 endpoint lets you request transcripts by symbol, quarter, and year using the pattern: https://financialmodelingprep.com/api/v3/earning_call_transcript/{symbol}?quarter={q}&year={y}&apikey=YOUR_API_KEY here’s how you can fetch NVIDIA’s transcript for a given quarter: import requestsAPI_KEY = "your_api_key"symbol = "NVDA"quarter = 2year = 2024url = f"https://financialmodelingprep.com/api/v3/earning_call_transcript/{symbol}?quarter={quarter}&year={year}&apikey={API_KEY}"response = requests.get(url)data = response.json()# Inspect the keysprint(data.keys())# Access transcript contentif "content" in data[0]: transcript_text = data[0]["content"] print(transcript_text[:500]) # preview first 500 characters The response typically includes details like the company symbol, quarter, year, and the full transcript text. If you aren’t sure which quarter to query, the “latest transcripts” endpoint is the quickest way to always stay up to date. Cleaning and Preparing Transcript Data Raw transcripts from the API often include long paragraphs, speaker tags, and formatting artifacts. Before sending them to an LLM, it helps to organize the text into a cleaner structure. Most transcripts follow a pattern: prepared remarks from executives first, followed by a Q&A session with analysts. Separating these sections gives better control when prompting the model. In Python, you can parse the transcript and strip out unnecessary characters. A simple way is to split by markers such as “Operator” or “Question-and-Answer.” Once separated, you can create two blocks — Prepared Remarks and Q&A — that will later be summarized independently. This ensures the model handles each section within context and avoids missing important details. Here’s a small example of how you might start preparing the data: import re# Example: using the transcript_text we fetched earliertext = transcript_text# Remove extra spaces and line breaksclean_text = re.sub(r'\s+', ' ', text).strip()# Split sections (this is a heuristic; real-world transcripts vary slightly)if "Question-and-Answer" in clean_text: prepared, qna = clean_text.split("Question-and-Answer", 1)else: prepared, qna = clean_text, ""print("Prepared Remarks Preview:\n", prepared[:500])print("\nQ&A Preview:\n", qna[:500]) With the transcript cleaned and divided, you’re ready to feed it into Groq’s LLM. Chunking may be necessary if the text is very long. A good approach is to break it into segments of a few thousand tokens, summarize each part, and then merge the summaries in a final pass. Summarizing with Groq LLM Now that the transcript is clean and split into Prepared Remarks and Q&A, we’ll use Groq to generate a crisp one-pager. The idea is simple: summarize each section separately (for focus and accuracy), then synthesize a final brief. Prompt design (concise and factual) Use a short, repeatable template that pushes for neutral, investor-ready language: You are an equity research analyst. Summarize the following earnings call sectionfor {symbol} ({quarter} {year}). Be factual and concise.Return:1) TL;DR (3–5 bullets)2) Results vs. guidance (what improved/worsened)3) Forward outlook (specific statements)4) Risks / watch-outs5) Q&A takeaways (if present)Text:<<<{section_text}>>> Python: calling Groq and getting a clean summary Groq provides an OpenAI-compatible API. Set your GROQ_API_KEY and pick a fast, high-quality model (e.g., a Llama-3.1 70B variant). We’ll write a helper to summarize any text block, then run it for both sections and merge. import osimport textwrapimport requestsGROQ_API_KEY = os.environ.get("GROQ_API_KEY") or "your_groq_api_key"GROQ_BASE_URL = "https://api.groq.com/openai/v1" # OpenAI-compatibleMODEL = "llama-3.1-70b" # choose your preferred Groq modeldef call_groq(prompt, temperature=0.2, max_tokens=1200): url = f"{GROQ_BASE_URL}/chat/completions" headers = { "Authorization": f"Bearer {GROQ_API_KEY}", "Content-Type": "application/json", } payload = { "model": MODEL, "messages": [ {"role": "system", "content": "You are a precise, neutral equity research analyst."}, {"role": "user", "content": prompt}, ], "temperature": temperature, "max_tokens": max_tokens, } r = requests.post(url, headers=headers, json=payload, timeout=60) r.raise_for_status() return r.json()["choices"][0]["message"]["content"].strip()def build_prompt(section_text, symbol, quarter, year): template = """ You are an equity research analyst. Summarize the following earnings call section for {symbol} ({quarter} {year}). Be factual and concise. Return: 1) TL;DR (3–5 bullets) 2) Results vs. guidance (what improved/worsened) 3) Forward outlook (specific statements) 4) Risks / watch-outs 5) Q&A takeaways (if present) Text: <<< {section_text} >>> """ return textwrap.dedent(template).format( symbol=symbol, quarter=quarter, year=year, section_text=section_text )def summarize_section(section_text, symbol="NVDA", quarter="Q2", year="2024"): if not section_text or section_text.strip() == "": return "(No content found for this section.)" prompt = build_prompt(section_text, symbol, quarter, year) return call_groq(prompt)# Example usage with the cleaned splits from Section 3prepared_summary = summarize_section(prepared, symbol="NVDA", quarter="Q2", year="2024")qna_summary = summarize_section(qna, symbol="NVDA", quarter="Q2", year="2024")final_one_pager = f"""# {symbol} Earnings One-Pager — {quarter} {year}## Prepared Remarks — Key Points{prepared_summary}## Q&A Highlights{qna_summary}""".strip()print(final_one_pager[:1200]) # preview Tips that keep quality high: Keep temperature low (≈0.2) for factual tone. If a section is extremely long, chunk at ~5–8k tokens, summarize each chunk with the same prompt, then ask the model to merge chunk summaries into one section summary before producing the final one-pager. If you also fetched headline numbers (EPS/revenue, guidance) earlier, prepend them to the prompt as brief context to help the model anchor on the right outcomes. Building the End-to-End Pipeline At this point, we have all the building blocks: the FMP API to fetch transcripts, a cleaning step to structure the data, and Groq LLM to generate concise summaries. The final step is to connect everything into a single workflow that can take any ticker and return a one-page earnings call summary. The flow looks like this: Input a stock ticker (for example, NVDA). Use FMP to fetch the latest transcript. Clean and split the text into Prepared Remarks and Q&A. Send each section to Groq for summarization. Merge the outputs into a neatly formatted earnings one-pager. Here’s how it comes together in Python: def summarize_earnings_call(symbol, quarter, year, api_key, groq_key): # Step 1: Fetch transcript from FMP url = f"https://financialmodelingprep.com/api/v3/earning_call_transcript/{symbol}?quarter={quarter}&year={year}&apikey={api_key}" resp = requests.get(url) resp.raise_for_status() data = resp.json() if not data or "content" not in data[0]: return f"No transcript found for {symbol} {quarter} {year}" text = data[0]["content"] # Step 2: Clean and split clean_text = re.sub(r'\s+', ' ', text).strip() if "Question-and-Answer" in clean_text: prepared, qna = clean_text.split("Question-and-Answer", 1) else: prepared, qna = clean_text, "" # Step 3: Summarize with Groq prepared_summary = summarize_section(prepared, symbol, quarter, year) qna_summary = summarize_section(qna, symbol, quarter, year) # Step 4: Merge into final one-pager return f"""# {symbol} Earnings One-Pager — {quarter} {year}## Prepared Remarks{prepared_summary}## Q&A Highlights{qna_summary}""".strip()# Example runprint(summarize_earnings_call("NVDA", 2, 2024, API_KEY, GROQ_API_KEY)) With this setup, generating a summary becomes as simple as calling one function with a ticker and date. You can run it inside a notebook, integrate it into a research workflow, or even schedule it to trigger after each new earnings release. Free Stock Market API and Financial Statements API... Conclusion Earnings calls no longer need to feel overwhelming. With the Financial Modeling Prep API, you can instantly access any company’s transcript, and with Groq LLM, you can turn that raw text into a sharp, actionable summary in seconds. This pipeline saves hours of reading and ensures you never miss the key results, guidance, or risks hidden in lengthy remarks. Whether you track tech giants like NVIDIA or smaller growth stocks, the process is the same — fast, reliable, and powered by the flexibility of FMP’s data. Summarize Any Stock’s Earnings Call in Seconds Using FMP API was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story
Share
Medium2025/09/18 14:40
Tom Lee Declares That Ethereum Has Bottomed Out

Tom Lee Declares That Ethereum Has Bottomed Out

Experienced analyst Tom Lee conducted an in-depth analysis of the Ethereum price. Here are some of the highlights from Lee's findings. Continue Reading: Tom Lee
Share
Bitcoinsistemi2026/03/20 19:05