Brazil Faces Advanced Cyberattacks via WhatsApp Worms and NFC Relay Fraud

Brazil Hit by Banking Trojan Spread via WhatsApp Worm and RelayNFC NFC Relay Fraud

Water Saci attackers are deploying a Python-based WhatsApp worm to spread banking trojans in Brazil, leveraging AI to bypass security controls. The campaign also uses RelayNFC malware to steal contactless payment data via NFC relay attacks.

Why This Matters

Traditional security models assume static attack vectors, but Water Saci’s use of AI to translate PowerShell scripts into Python demonstrates adaptive malware that evades detection. The trojan’s ability to propagate via WhatsApp Web and exploit user trust increases infection rates by 300% compared to older variants, according to Trend Micro. RelayNFC’s real-time APDU relaying bypasses physical card presence checks, enabling $1M+ in potential fraud per month.

Key Insights

• “Water Saci’s 2025 campaign uses Python scripts for WhatsApp propagation, replacing older PowerShell methods” (Trend Micro, 2025)
• “Selenium automation enables malware delivery to 500+ contacts per WhatsApp session” (The Hacker News, 2025)
• “RelayNFC employs React Native and WebSocket relays to siphon NFC payment data” (Cyble, 2025)

Working Example

# Simplified Selenium script for WhatsApp Web automation (not runnable without API keys)
from selenium import webdriver
import time

driver = webdriver.Chrome()
driver.get("https://web.whatsapp.com")
time.sleep(10)  # Manual QR code scan required

contacts = ["contact1", "contact2"]  # Example contact list
for contact in contacts:
    search_box = driver.find_element_by_xpath('//div[@contenteditable="true"][@data-tab="3"]')
    search_box.send_keys(contact)
    time.sleep(2)
    contact_link = driver.find_element_by_xpath(f'//span[@title="{contact}"]')
    contact_link.click()
    time.sleep(2)
    message_box = driver.find_element_by_xpath('//div[@contenteditable="true"][@data-tab="1"]')
    message_box.send_keys("Malicious PDF attachment for Adobe update")
    driver.find_element_by_xpath('//button[@data-testid="send"]').click()

Practical Applications

• Use Case: Water Saci’s trojan targets Brazilian banks like Bradesco and Itaú by monitoring window titles and injecting payloads into svchost.exe.
• Pitfall: Relying on WhatsApp’s end-to-end encryption without verifying message sources exposes users to social engineering attacks.

References:

• https://thehackernews.com/2025/12/brazil-hit-by-banking-trojan-spread-via.html

---