Brazil Hit by Banking Trojan Spread via WhatsApp Worm and RelayNFC NFC Relay Fraud

Water Saci threat actors are actively targeting Brazilian users with an evolved banking trojan campaign. The attack chain uses HTML Application (HTA) files and PDFs distributed via WhatsApp worm to deploy malware. Attackers have shifted from PowerShell to Python-based variants for propagation. The campaign combines traditional banking trojans with NFC relay fraud techniques called RelayNFC. The sophisticated multi-layered infection chain represents an evolution in the group's tactics targeting Brazil's financial sector.