Further testing by BleepingComputer shows that PHP files (.php) are also not included in WhatsApp's blocklist. Python, PHP scripts not blocked ...

The stealer's code is an obfuscated (Base64) PHP script, which is deciphered directly on memory without touching the disk, minimizing the chances of being detected.