Astaroth banking Trojan spreads in Brazil via WhatsApp worm

Astaroth, a long-running Brazilian banking malware, has evolved in a campaign dubbed Boto Cor-de-Rosa that uses WhatsApp Web for propagation. According to Acronis, the malware harvests the victim’s WhatsApp contacts and automatically sends each of them a new malicious ZIP file, creating a self-reinforcing worm-like spread. The main Astaroth payload remains Delphi-based, but the new WhatsApp worm component is implemented in Python, with an MSI dropper that uses a legitimate AutoIt interpreter.

The campaign targets Brazilian victims with region-specific lures and messages in Portuguese, and the infection chain relies on a disguised VBScript hidden in a malicious ZIP file that downloads additional payloads. The Python module installs its own runtime and allows the WhatsApp-based spreading mechanism to dispatch infected ZIPs and exfiltrate contacts to a remote server, while the banking module monitors URLs to trigger credential theft. This campaign highlights how infection chains are blending social engineering with automated propagation to target local users.