Cybersecurity researchers have uncovered a new campaign exploiting WhatsApp to distribute the Astaroth banking trojan in Brazil, employing multi-language modular components. This evolving tactic significantly enhances malware spread and data theft capabilities through social engineering and automated contact propagation. #Astaroth #Guildma #WaterMakara #STAC3150
Keypoints
- The campaign uses WhatsApp to spread the Astaroth banking malware among Brazilian users.
- Malicious messages are automatically sent to contacts via a Python-based worm module, enabling worm-like propagation.
- The malware delivers ZIP archives with scripts that download subsequent infection components and gather user data.
- A multi-stage attack involves a Visual Basic Script, PowerShell, and Python modules for propagation and credential theft.
- The campaign includes real-time tracking of propagation metrics to optimize malware dissemination.
Read More: https://thehackernews.com/2026/01/whatsapp-worm-spreads-astaroth-banking.html