WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging

Cybersecurity researchers have revealed a WhatsApp-based worm campaign that distributes the Windows banking trojan Astaroth across Brazil, under the codename Boto Cor-de-Rosa. The campaign uses WhatsApp to retrieve a victim’s contacts and automatically forwards malicious messages to each contact, increasing its spread in a worm-like fashion.

Astaroth, also known as Guildma, has been a banking malware threat since 2015, with recent activity noted from September 24, 2025, and reports describe ZIP archives containing a downloader that fetches a PowerShell or Python script to harvest data and an MSI installer to deploy the trojan.

The current campaign adds a WhatsApp-based worm module written in Python, alongside core components; the downloader and Visual Basic Script-based installer were described by Acronis Threat Research Unit, which noted real-time propagation metrics such as messages delivered and failures. The campaign features two modules: a Python-based propagation module that auto-forwards malicious ZIP files to contacts, and a banking module that monitors web activity to harvest credentials when banking-related URLs are visited.

Last month, Trend Micro highlighted Water Saci’s use of WhatsApp to spread Maverick and Casbaneiro variants, underscoring the growing use of the messaging platform as a distribution vector in Brazil. according to Acronis Threat Research Unit.