Do Son K7 Labs exposed a Brazilian campaign using a Python WhatsApp worm for self-propagation. The in-memory AutoIt loader deploys a banking trojan that uses IMAP email as a covert C2 channel to steal banking credentials.
IMAP C2
Trustwave exposed Eternidade Stealer, a sophisticated Brazilian Trojan. The Python WhatsApp worm steals contact lists and uses IMAP email for covert C2 retrieval to launch banking overlays.
Trend exposed the Water Saci worm, a self-propagating campaign that hijacks WhatsApp Web using Selenium/PowerShell. It uses a stealthy IMAP email C2 channel with HTTP fallback.