THE Astaroth WhatsApp spambot is an emerging threat linked to a LATAM banking trojan, designed to spread malicious software via WhatsApp contact lists. Initiated in Q4 2025, this spambot operates by running a hidden browser, accessing victims' contact lists, and sending malware-laden messages to contacts with Brazilian phone numbers. The actor behind Astaroth remains unidentified, but CrowdStrike confirms a potential connection to Vareg, another spambot distributing banking trojans. Protective measures include monitoring for unusual WebDriver downloads and being cautious of unexpected ZIP attachments.
Astaroth spambot spreads LATAM trojan via WhatsApp to Brazilians
CyberSIXT Evidence Panel
Primary Source
crowdstrike.com
Article by CyberSIXT