Loading story…
The Astaroth banking trojan has added a spambot component that hijacks victims’ active WhatsApp Web sessions to distribute malicious ZIP attachments, with activity primarily targeting users in Brazil. According to CrowdStrike, the malware launches a headless Chromium or Microsoft Edge browser through WebDriver, suppresses automation indicators, checks whether the victim is already logged in to WhatsApp Web, and then uses the legitimate WPPConnect/WA-JS library to enumerate contacts and send messages that appear to come from the victim’s own account.
The spambot is designed to maximize delivery while reducing suspicion, filtering out groups, broadcasts, linked devices, unsaved contacts, the victim’s own account, and non-Brazilian phone numbers, while tailoring Portuguese greetings by time of day before sending lures. CrowdStrike also found substantial code and configuration overlap with the earlier Vareg spambot—including nearly identical contact filtering, message delivery logic, and delay behavior—indicating likely code sharing or a common developer; researchers published detection guidance, a YARA rule, and related filesystem, telemetry, hash, and domain indicators tied to the campaign.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-07, CrowdStrike published technical analysis of Astaroth's new spambot component, describing its use of headless browsers, WhatsApp Web session abuse, and the WA-JS/WPPConnect library to send malicious ZIP attachments to Brazil-based contacts. The report also documented code overlap with the earlier Vareg spambot and provided detection guidance, indicators, and a YARA rule.
CrowdStrike reported that Astaroth started distributing its own spambot component in Q4 2025 to abuse victims' WhatsApp Web sessions for malware delivery. The report notes this activity emerged around the time earlier Vareg spambot activity ceased.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a Brazil-focused malware campaign that hijacks **WhatsApp Web** sessions to spread a malicious ZIP archive and deploy the **Eternidade Stealer** banking trojan. The infection chain uses an obfuscated **VBScript** downloader, an **MSI** dropper, an **AutoIt** loader, and a final **Delphi-based** payload, while a parallel Python-based worm installs **Selenium** and **ChromeDriver** to steal contacts and automatically send phishing messages to the victim’s WhatsApp contacts. The malware is heavily localized, checking for **Portuguese (Brazil)** language settings and focusing on Brazilian banks, fintech services, and cryptocurrency platforms. Once installed, the malware profiles the host, enumerates security products, monitors browser history and banking activity, and uses overlays and credential theft when targeted financial services are detected. Analysts said later stages are decrypted and loaded in memory, including reflective loading and **process hollowing** into `svchost.exe`, while command-and-control relies on attacker infrastructure including a PHP server, `013net.com.br`, and **IMAP over SSL** with hardcoded email credentials to retrieve updated infrastructure, with a fallback domain if that fails. The campaign, also tracked as a **Water-Saci/SorvePotel** variant and compared with older Brazilian banking trojans such as **Casbaneiro**, shows an evolving effort to combine messaging-platform worming with banking fraud and credential theft.
Aug 14, 2026
Cybersecurity researchers have identified a new campaign targeting Brazilian users in which the Eternidade Stealer, a Delphi-based banking trojan, is distributed through a WhatsApp worm. The attack leverages social engineering and WhatsApp hijacking, with the threat actor deploying a Python script—marking a shift from previous PowerShell-based methods—to hijack WhatsApp Web sessions and spread malicious attachments. The campaign uses an obfuscated Visual Basic Script as the initial infection vector, which then drops a batch script responsible for delivering two payloads, including the Python-based worm. The malware utilizes the Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses, allowing the attacker to update C2 infrastructure as needed. This activity is part of a broader trend in Brazil, where WhatsApp's ubiquity makes it a favored vector for distributing banking trojans and information stealers. The use of Delphi for malware development remains prevalent in Latin America due to its technical efficiency and regional familiarity. Researchers note that this campaign represents an evolution in tactics, building on previous attacks such as Water Saci, and highlights the increasing sophistication of social engineering and malware propagation techniques in the region's cybercrime ecosystem.
Jun 29, 2026
A new malware campaign, identified as SORVEPOTEL, has been actively targeting Windows users in Brazil by exploiting the WhatsApp messaging platform as its primary infection vector. The campaign is engineered for rapid propagation rather than data theft or ransomware, focusing on widespread distribution through social engineering tactics. Attackers initiate the infection by sending convincing phishing messages from already compromised WhatsApp accounts, which increases the credibility of the malicious communication. These messages contain ZIP file attachments that masquerade as legitimate documents, such as receipts or health app files, and are specifically crafted to require opening on a desktop, indicating a focus on enterprise environments. Upon opening the ZIP file, victims are prompted to execute a Windows shortcut (LNK) file, which silently triggers the malware installation on the system. Once installed, SORVEPOTEL leverages active WhatsApp Web sessions to automatically send the same malicious ZIP file to all contacts and groups associated with the victim’s account, enabling rapid self-propagation. This automated spamming behavior often results in the infected WhatsApp accounts being banned due to excessive activity. Trend Micro telemetry indicates that out of 477 detected cases, 457 occurred in Brazil, highlighting a strong regional focus. The campaign has notably impacted government and public service organizations, but has also affected entities in manufacturing, technology, education, and construction sectors. While the primary goal appears to be mass distribution, there is concern that similar techniques have previously been used in Brazil to target financial data, raising the risk of future campaigns with more damaging objectives. Researchers have also observed that, in addition to WhatsApp, the attackers may use email as a secondary distribution channel, sending the same malicious ZIP files from seemingly legitimate email addresses. The use of social trust and automation in this campaign demonstrates a sophisticated approach to maximizing infection rates. There is currently no evidence that SORVEPOTEL exfiltrates data or encrypts files, but the potential for further exploitation remains. The campaign underscores the importance of user awareness regarding phishing tactics, especially those leveraging trusted communication platforms. Security teams are advised to monitor for suspicious WhatsApp Web activity and educate users about the risks of opening unsolicited attachments. The incident highlights the evolving threat landscape where messaging platforms are increasingly abused for malware propagation, particularly in regions with high platform adoption.
Jun 29, 2026