Threat reportMalwareTL-2026-1785
Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign Self-Propagates Across Brazil
Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot (TL-2026-1785), also tracked as Guildma, is a high-severity malware campaign, first published 2026-07-31. It has no confirmed attribution, affects Microsoft Windows (desktop endpoints, all currently supported 10/11, maps to 46 MITRE ATT&CK techniques (T1016, T1027.002, T1027.010), and is covered by 9 detection rules and 47 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 46MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 47Indicators of compromise
Key facts for TL-2026-1785
- Threat ID
- TL-2026-1785
- Also known as
- Guildma, Boto Cor-de-Rosa, STAC3150
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, consumer, ecommerce, cryptocurrency exchanges
- Target regions
- brazil, Latin America, united states of america, austria
- Detection rules
- 9
- Indicators of compromise
- 47
- Updates
- 2026-07-31 · revalidated 1× · latest source
Malware and tooling in Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot
Malware and tooling: Astaroth, AutoIt, DelphiEncryptionCompendium, Selenium WebDriver, WPPConnect/WA-JS
How Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot works
The Astaroth (Guildma) banking trojan has integrated a new WhatsApp Web spambot module — tracked as STAC3150 / "Boto Cor-de-Rosa" — that uses headless Selenium WebDriver automation and the WPPConnect/WA-JS library to hijack victims' WhatsApp Web sessions, harvest Brazilian (+55) contacts, and mass-send malicious ZIP attachments, turning infected hosts into self-propagating spam relays. First observed September 24, 2025, the campaign has hit 250+ organizations (95%+ in Brazil) and delivers credential-stealing Delphi malware to financial-sector victims via AES-CBC/CTS + DelphiEncryptionCompendium-encrypted payloads and configuration.
Astaroth (also tracked as Guildma) is a Delphi-based banking trojan active in Latin America since at least 2015, historically distributed via email phishing and best known for abusing legitimate Windows/antivirus processes to steal credentials. In Q4 2025 its operators — tracked by Sophos as campaign STAC3150 and later named "Boto Cor-de-Rosa" by the Acronis Threat Research Unit — escalated distribution by weaponizing WhatsApp Web itself, turning every infected host into a self-propagating spam relay.
The infection chain begins with a WhatsApp message (frequently disguised behind the "View Once" media option) delivering a ZIP archive containing a malicious VBS or HTA downloader. Executed by the victim, this launches PowerShell to retrieve second-stage payloads — a PowerShell or Python script that harvests the victim's WhatsApp session/contact data, and an AutoIt-based installer (in later cases an MSI, installer.msi) that decodes and loads a Delphi loader DLL in memory, which in turn decrypts and executes the core Astaroth payload.
The new spambot component is a 32-bit Delphi PE that downloads a legitimate Selenium-compatible WebDriver for Chrome or Edge via PowerShell, clones the browser profile into C:\Users\Public\Temp\ChromeAuto_<BROWSER_ID><DATE>, and launches a headless browser session on a random local port (31175–39999) using flags (--headless, --disable-infobars, --window-size=1920,1080) and excludeSwitches (enable-automation, test-type) specifically chosen to strip the "Chrome is being controlled by automated test software" indicators. It then loads the WPPConnect/WA-JS library — a legitimate open-source project that exposes WhatsApp Web's internal JS API — to enumerate the victim's contacts, filtering out group chats (@g.us), broadcast lists (@broadcast), and linked devices (@lid), and retaining only numbers beginning with Brazil's +55 country code. For each retained contact it composes a Portuguese-language greeting, randomly selects a URL from an embedded list (ArrURL), and sends three messages carrying a Base64-encoded ZIP containing a fresh Astaroth downloader — restarting the infection chain on the next victim.
Configuration and core payloads are protected by a custom obfuscated format: a magic word (EF01) precedes a Base64-encoded blob that is AES-encrypted using AES-CBC with ciphertext stealing (CTS) via the DelphiEncryptionCompendium library, with the final 32 bytes an HMAC-SHA256 integrity tag keyed with the string "TenHaVunf!@#2026". C2 communication has evolved over the campaign's life: initial STAC3150 activity in late September 2025 used IMAP polling of an attacker-controlled mailbox, shifting in early October 2025 to HTTP-based PowerShell Invoke-WebRequest polling of dedicated C2 domains registered on abuse-prone TLDs (.sbs, .top) and typosquatted brand/business names.
CrowdStrike assesses — with moderate confidence — that code overlap between the Astaroth spambot and a similar spambot used by the related "Vareg" WhatsApp operation indicates a shared developer or code-sharing arrangement within the broader LATAM e-crime ecosystem, which also includes Trend Micro's "Water Saci" (aka Augmented Marauder) actor distributing the Maverick and Casbaneiro banking trojans via near-identical WhatsApp Web worm techniques, and the separately reported Eternidade Stealer. No formal, named attribution to a single threat actor exists at this time. Targeting is concentrated on Brazilian financial-sector users and consumers, with secondary infections observed in the U.S. and Austria.
MITRE ATT&CK techniques used in TL-2026-1785
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1124 System Time Discovery; T1518.001 Security Software Discovery
Defense Evasion
T1027.002 Software Packing; T1027.010 Command Obfuscation; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1218.001 Compiled HTML File; T1218.007 Msiexec; T1218.010 Regsvr32; T1220 XSL Script Processing; T1497.001 System Checks; T1564.003 Hidden Window; T1564.004 NTFS File Attributes; T1574.001 DLL
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.007 JavaScript; T1129 Shared Modules; T1204.002 Malicious File
Collection
T1056.001 Keylogging; T1074.001 Local Data Staging; T1113 Screen Capture; T1115 Clipboard Data; T1119 Automated Collection; T1185 Browser Session Hijacking
Credential Access
T1056.004 Credential API Hooking; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Command and Control
T1071.001 Web Protocols; T1071.003 Mail Protocols; T1090.002 External Proxy; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1568.002 Domain Generation Algorithms
Persistence
T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot
- Microsoft — Windows (desktop endpoints, all currently supported 10/11 builds)
Vulnerable versions: any unmanaged Windows endpoint capable of running PowerShell, VBS/HTA, and AutoIt - Meta (WhatsApp Inc.) — WhatsApp Web / WhatsApp Desktop sessions
Vulnerable versions: any linked WhatsApp Web session on an infected host, abused via Selenium WebDriver + WPPConnect/WA-JS - Google / Microsoft — Chrome / Edge (WebDriver-compatible installations)
Vulnerable versions: any version compatible with Selenium WebDriver automation, abused via a legitimately downloaded WebDriver binary
Remediation for Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot
Patches
- No vendor patch applies — this is a malware/social-engineering distribution campaign, not a software vulnerability
Immediate actions
- Block the identified C2 domains at DNS/perimeter: stretar7.contabilfacil.sbs, graconxonjal.empresaeficiente.sbs, plansonval.impostosrapido.top, manoelimoveiscaioba.com, varegjopeaks.com, docsmoonstudioclayworks.online, shopeeship.com, miportuarios.com, borizerefeicoes.com, clhttradinglimited.com, lefthandsuperstructures.com
- Hunt for C:\Users\Public\Temp\ChromeAuto_* directories and unexpected headless Chrome/Edge WebDriver processes listening on ports 31175-39999
- Alert on PowerShell-initiated WebDriver/browser downloads and on AutoIt (Troj/AutoIt-DJB) or HTA (Troj/HTADrp-CE) execution matching Sophos's eight published signatures
- Warn WhatsApp users who receive unsolicited ZIP-containing 'View Once' messages — even from known contacts — not to open them, and to verify via a separate channel before trusting the sender
Workarounds
- Disable or tightly restrict WhatsApp Web/Desktop linked-device access on corporate-managed endpoints
- Require out-of-band verification before opening unsolicited archive attachments received via messaging apps
Longer-term hardening
- Deploy EDR with behavioral detection for headless-browser automation and WebDriver-driven browser session hijacking (CrowdStrike Falcon LogScale query and YARA rule referenced in vendor reporting)
- Enforce application allow-listing to block unauthorized Selenium/ChromeDriver/EdgeDriver and AutoIt binaries on end-user endpoints
- Run security-awareness training for financial-sector staff and Brazilian consumers on WhatsApp-borne worm lures, including the 'View Once' social-engineering hook
- Monitor for anomalous WhatsApp Web linked-device activity and abnormal outbound message volume per account
Timeline of Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot
- Astaroth (Guildma) banking trojan first identified in the wild, targeting Latin American and Brazilian users with credential-theft capability.
- Sophos first observes the STAC3150 campaign delivering Astaroth via malicious WhatsApp 'View Once' ZIP lures containing VBS/HTA downloaders.
- Trend Micro documents the related 'Water Saci' (Augmented Marauder) threat actor distributing Maverick and Casbaneiro banking trojans via a self-propagating WhatsApp Web worm module in Brazil.
- STAC3150 operators shift second-stage C2 communication from attacker-controlled IMAP mailboxes to HTTP-based PowerShell Invoke-WebRequest polling of registered C2 domains.
- STAC3150 introduces an MSI installer and AutoIt loader delivering the Astaroth banking trojan via manoelimoveiscaioba.com; the cluster is assessed to have affected 250+ organizations, ~95% in Brazil (Sophos).
- Maverick WhatsApp malware reported hijacking browser sessions to target Brazil's largest banks, part of the same LATAM WhatsApp-worm wave as Astaroth/STAC3150.
- Trustwave SpiderLabs discloses Eternidade Stealer, a Python rewrite of the WhatsApp-hijack worm technique, TTP-overlapping with the Water Saci/SORVEPOTEL cluster.
- Sophos publishes a technical writeup of the STAC3150 campaign, reporting over 250 impacted customers (~95% in Brazil) and eight detection signatures for the VBS/HTA/AutoIt loader chain.
- The Hacker News reports continued Brazil-focused WhatsApp-worm banking trojan activity alongside a related RelayNFC NFC-relay fraud wave.
- Blackpoint Cyber publishes technical analysis of the SORVEPOTEL WhatsApp worm (tracked by Acronis as 'Boto Cor-de-Rosa') delivering Astaroth via Selenium/ChromeDriver WhatsApp Web session hijacking.
- Acronis Threat Research Unit names the resurfaced Astaroth WhatsApp-worm activity 'Boto Cor-de-Rosa,' noting the propagation module is now written entirely in Python and that >95% of impacted devices are in Brazil, with secondary infections in the U.S. and Austria.
- CrowdStrike identifies integration of a dedicated WhatsApp Web spambot module (Selenium WebDriver + WPPConnect/WA-JS) into the Astaroth toolkit, marking an escalation from traditional email phishing to automated worm-like distribution; code overlap with the Vareg spambot suggests a shared developer within the LATAM e-crime ecosystem.
- PE build timestamp (04:14:16 UTC) recorded on the encrypted spambot component sample analyzed by CrowdStrike.
- Casbaneiro phishing campaign, a malware family sharing the LATAM WhatsApp-worm distribution ecosystem, reported targeting Latin America and Europe via dynamic PDF lures.
- Picus Security documents Astaroth's use of steganographic GitHub-hosted images for configuration distribution and Ngrok reverse-proxy tunnels for C2 resilience.
- GBHackers publishes coverage of the CrowdStrike Astaroth WhatsApp Web spambot analysis, triggering this threat-intel hunt.
Update history for TL-2026-1785
- 2026-07-31 — Astaroth Banking Trojan Adds WhatsApp Web Spambot Component to Self-Propagate via Compromised Accounts: What changed Core severity/exploitability/status/attribution-confidence assessment is unchanged (HIGH / ACTIVE / ACTIVE / LOW) -- the newer report corroborates rather than escalates the existing record. New indicators (19) 1 new C2 domain (
Sources cited for Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot
- Astaroth Banking Trojan Adds WhatsApp Web Spambot to Spread Malware Across Brazil
- Inside Astaroth's New Spambot Component
- WhatsApp compromise leads to Astaroth deployment
- WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging
- Astaroth's Boto Cor-de-Rosa campaign targets Brazil with new WhatsApp malware technique
- Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp
- Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users
- WhatsApp Malware 'Maverick' Hijacks Browser Sessions to Target Brazil's Biggest Banks
- Brazil Hit by Banking Trojan Spread via WhatsApp Worm and RelayNFC NFC Relay Fraud
- Astaroth, Software S0373
- Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures
Detection coverage for TL-2026-1785
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1785 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1785
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.