“Boto Cor-de-Rosa”: Banking Malware Astaroth Pivots to WhatsApp in New Campaign

The Brazilian banking malware Astaroth has evolved again, turning WhatsApp into a tool for its latest campaign dubbed “Boto Cor-de-Rosa,” with researchers from the Acronis Threat Research Unit uncovering the move to exploit WhatsApp Web to spread itself by automating malicious messages to victims’ contact lists. The new iteration introduces a Python-based worm module designed specifically for WhatsApp, with infection beginning when a user receives a malicious ZIP archive via the messaging app.

Once the victim extracts the file and executes the disguised Visual Basic script, the malware takes root and becomes a spambot that propagates by hijacking the victim’s WhatsApp Web session to retrieve their contact list and automatically send malicious messages to each contact. It logs statistics for operators, tracking the number of messages delivered, failed attempts, and sending rate, and it even calculates efficiency after every 50 messages.

The campaign also exfiltrates the victim’s contact list to a remote server, providing attackers with numbers for future campaigns, while the core payload remains Delphi and the installer uses Visual Basic. According to Acronis Threat Research Unit.