The operators of Astaroth, a Brazilian banking trojan that has been around for a decade, have bolted on a component that quietly signs into WhatsApp Web on an infected PC and messages every contact in the victim's address book, turning each infected person into an unwitting distributor of the malware.
CrowdStrike researcher Kevin Ratto documented the new spambot in a technical breakdown, tracing its arrival to the fourth quarter of 2025, when the command and control servers behind Astaroth's installer began serving the extra payload. It is a real shift in tactics: Astaroth, also tracked as Guildma, had propagated mainly through email spam, and a file arriving over a messaging app from someone the recipient actually knows is far harder to wave away.
How it works
The spambot drives a genuine browser rather than talking to an API. It launches a browser instance in headless mode, meaning no window is ever drawn on screen, and strips the usual automation markers out of its WebDriver session so that WhatsApp Web sees what looks like an ordinary logged-in user. Because the victim is already authenticated on that machine, the malware inherits the session and never needs credentials. The entire spam run happens invisibly while the victim keeps working.
Targeting is narrow and deliberate. Ratto found Brazil-specific phone number filtering, Portuguese-language spam templates and language-oriented HTTP headers, all pointing at a Brazilian victim pool, which matches where Astaroth now operates exclusively. The malware itself has been active since at least 2015 as a combined banking trojan and information stealer. It arrives as a Windows shortcut file running JScript, which pulls down an installer, which runs an AutoIt-based loader, which decodes a Delphi loader DLL in memory before the core payload executes. Those same loaders decrypt the spambot component using AES in CTS mode from an open source Delphi library.
A shared toolkit in the region
The more consequential finding is who else has this code. CrowdStrike reports that the Astaroth spambot and a separate spambot called Vareg, also tracked as WATER SACI and Eternidade, share function names, variable names, file delivery logic, contact-filtering implementations and configuration field naming conventions. Vareg was already pushing other Latin American banking trojans through WhatsApp Web in campaigns during October and November 2025. That points to a development relationship between the two, and to a regional criminal ecosystem where propagation code gets written once and reused across malware families, a pattern also visible in the crews extorting Latin American firms with BitLocker.
What you should do
Treat unexpected WhatsApp messages carrying files as hostile even when they come from a known contact, and brief staff in Brazilian operations specifically, since the lure arrives in Portuguese from a real colleague or relative. On the endpoint, alert on browser processes launched in headless mode with automation flags by anything other than a known test harness, on AutoIt binaries running from user-writable paths, and on shortcut files that invoke a script interpreter. CrowdStrike published a sample hash for the spambot component: d89105c4d567a95f674ed6eac538e32e288b658a4222a3d52e284a77782af4d5.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.