Astaroth Abuses WhatsApp Web Sessions to Send Malware Spam
Malware Intelligence · 2 sources · Updated 3mo ago · First seen Jun 7, 2026
The Astaroth banking trojan has added a spambot component that hijacks victims’ active WhatsApp Web sessions to distribute malicious ZIP attachments, with activity primarily targeting users in Brazil. According to CrowdStrike, the malware launches a headless Chromium or Microsoft Edge browser through WebDriver, suppresses automation indicators, checks whether the victim is already logged in to WhatsApp Web, and then uses the legitimate WPPConnect/WA-JS library to enumerate contacts and send messages that appear to come from the victim’s own account.
The spambot is designed to maximize delivery while reducing suspicion, filtering out groups, broadcasts, linked devices, unsaved contacts, the victim’s own account, and non-Brazilian phone numbers, while tailoring Portuguese greetings by time of day before sending lures. CrowdStrike also found substantial code and configuration overlap with the earlier Vareg spambot—including nearly identical contact filtering, message delivery logic, and delay behavior—indicating likely code sharing or a common developer; researchers published detection guidance, a YARA rule, and related filesystem, telemetry, hash, and domain indicators tied to the campaign.
