Sophisticated WhatsApp Worm Uses Fake “View Once” Lure to Hijack Sessions and Deploy Astaroth Banking Trojan

Sophos analysts are tracking a persistent, fast-evolving malware campaign targeting WhatsApp users in Brazil, which uses fake “View Once” messages, malicious archive attachments, hijacked WhatsApp Web sessions, and the Astaroth (Guildma) banking trojan. Officially tracked as STAC3150, the campaign has been active since 24 September 2025 and has already impacted more than 250 customers, with the majority of infections in Brazil.

The attack chain runs from WhatsApp phishing to malicious archives, a VBS/HTA downloader, a C2, WhatsApp session hijacking, and ultimately Astaroth deployment, with the lure containing friendly Portuguese messages.

The second-stage payloads are delivered via PowerShell or Python scripts, which later shift to HTTP-based communication contacting a remote C2 server hosted on varegjopeaks[.]com, and the MSI installer writes multiple files to disk, creates a startup registry key for persistence, and executes a malicious AutoIt script disguised as a .log file.

The operation also uses the Selenium Chrome WebDriver and the WPPConnect library to harvest session tokens and contact lists, enabling the attackers to re-run the infection cycle and spread malicious ZIPs to new victims. The campaign has infected more than 250 devices, overwhelmingly in Brazil, and the malware communicates with a C2 server hosted at manoelimoveiscaioba[.]com.