# Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign Self-Propagates Across Brazil

> The Astaroth (Guildma) banking trojan has integrated a new WhatsApp Web spambot module — tracked as STAC3150 / "Boto Cor-de-Rosa" — that uses headless Selenium WebDriver automation and the WPPConnect/WA-JS library to hijack victims' WhatsApp Web sessions, harvest Brazilian (+55) contacts, and mass-send malicious ZIP attachments, turning infected hosts into self-propagating spam relays. First observed September 24, 2025, the campaign has hit 250+ organizations (95%+ in Brazil) and delivers credential-stealing Delphi malware to financial-sector victims via AES-CBC/CTS + DelphiEncryptionCompendium-encrypted payloads and configuration.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T08:28:45.535Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1785
- **ID:** TL-2026-1785
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Astaroth (also tracked as Guildma) is a Delphi-based banking trojan active in Latin America since at least 2015, historically distributed via email phishing and best known for abusing legitimate Windows/antivirus processes to steal credentials. In Q4 2025 its operators — tracked by Sophos as campaign STAC3150 and later named "Boto Cor-de-Rosa" by the Acronis Threat Research Unit — escalated distribution by weaponizing WhatsApp Web itself, turning every infected host into a self-propagating spam relay.

The infection chain begins with a WhatsApp message (frequently disguised behind the "View Once" media option) delivering a ZIP archive containing a malicious VBS or HTA downloader. Executed by the victim, this launches PowerShell to retrieve second-stage payloads — a PowerShell or Python script that harvests the victim's WhatsApp session/contact data, and an AutoIt-based installer (in later cases an MSI, installer.msi) that decodes and loads a Delphi loader DLL in memory, which in turn decrypts and executes the core Astaroth payload.

The new spambot component is a 32-bit Delphi PE that downloads a legitimate Selenium-compatible WebDriver for Chrome or Edge via PowerShell, clones the browser profile into C:\Users\Public\Temp\ChromeAuto_<BROWSER_ID><DATE>, and launches a headless browser session on a random local port (31175–39999) using flags (--headless, --disable-infobars, --window-size=1920,1080) and excludeSwitches (enable-automation, test-type) specifically chosen to strip the "Chrome is being controlled by automated test software" indicators. It then loads the WPPConnect/WA-JS library — a legitimate open-source project that exposes WhatsApp Web's internal JS API — to enumerate the victim's contacts, filtering out group chats (@g.us), broadcast lists (@broadcast), and linked devices (@lid), and retaining only numbers beginning with Brazil's +55 country code. For each retained contact it composes a Portuguese-language greeting, randomly selects a URL from an embedded list (ArrURL), and sends three messages carrying a Base64-encoded ZIP containing a fresh Astaroth downloader — restarting the infection chain on the next victim.

Configuration and core payloads are protected by a custom obfuscated format: a magic word (EF01) precedes a Base64-encoded blob that is AES-encrypted using AES-CBC with ciphertext stealing (CTS) via the DelphiEncryptionCompendium library, with the final 32 bytes an HMAC-SHA256 integrity tag keyed with the string "TenHaVunf!@#2026". C2 communication has evolved over the campaign's life: initial STAC3150 activity in late September 2025 used IMAP polling of an attacker-controlled mailbox, shifting in early October 2025 to HTTP-based PowerShell Invoke-WebRequest polling of dedicated C2 domains registered on abuse-prone TLDs (.sbs, .top) and typosquatted brand/business names.

CrowdStrike assesses — with moderate confidence — that code overlap between the Astaroth spambot and a similar spambot used by the related "Vareg" WhatsApp operation indicates a shared developer or code-sharing arrangement within the broader LATAM e-crime ecosystem, which also includes Trend Micro's "Water Saci" (aka Augmented Marauder) actor distributing the Maverick and Casbaneiro banking trojans via near-identical WhatsApp Web worm techniques, and the separately reported Eternidade Stealer. No formal, named attribution to a single threat actor exists at this time. Targeting is concentrated on Brazilian financial-sector users and consumers, with secondary infections observed in the U.S. and Austria.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1583.001 Domains
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1047 Windows Management Instrumentation
- T1204.002 Malicious File
- T1129 Shared Modules
- T1547.001 Registry Run Keys / Startup Folder
- T1547.009 Shortcut Modification
- T1140 Deobfuscate/Decode Files or Information
- T1564.003 Hidden Window
- T1564.004 NTFS File Attributes
- T1574.001 DLL
- T1027.002 Software Packing
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1497.001 System Checks
- T1218.001 Compiled HTML File
- T1218.010 Regsvr32
- T1220 XSL Script Processing
- T1055.012 Process Hollowing
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1057 Process Discovery
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1115 Clipboard Data
- T1056.001 Keylogging
- T1119 Automated Collection
- T1185 Browser Session Hijacking
- T1074.001 Local Data Staging
- T1132.001 Standard Encoding
- T1568.002 Domain Generation Algorithms
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1071.003 Mail Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Astaroth Banking Trojan Adds WhatsApp Web Spambot to Spread Malware Across Brazil](https://gbhackers.com/astaroth-banking-trojan/)
- [Inside Astaroth's New Spambot Component](https://www.crowdstrike.com/en-us/blog/inside-astaroths-new-spambot-component/)
- [WhatsApp compromise leads to Astaroth deployment](https://www.sophos.com/en-us/blog/whatsapp-compromise-leads-to-astaroth-deployment)
- [WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging](https://thehackernews.com/2026/01/whatsapp-worm-spreads-astaroth-banking.html)
- [Astaroth's Boto Cor-de-Rosa campaign targets Brazil with new WhatsApp malware technique](https://www.acronis.com/en/tru/posts/boto-cor-de-rosa-campaign-reveals-astaroth-whatsapp-based-worm-activity-in-brazil/)
- [Unraveling Water Saci's New Multi-Format, AI-Enhanced Attacks Propagated via WhatsApp](https://www.trendmicro.com/en_us/research/25/l/water-saci.html)
- [Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users](https://www.trendmicro.com/en_us/research/25/j/self-propagating-malware-spreads-via-whatsapp.html)
- [WhatsApp Malware 'Maverick' Hijacks Browser Sessions to Target Brazil's Biggest Banks](https://thehackernews.com/2025/11/whatsapp-malware-maverick-hijacks.html)
- [Brazil Hit by Banking Trojan Spread via WhatsApp Worm and RelayNFC NFC Relay Fraud](https://thehackernews.com/2025/12/brazil-hit-by-banking-trojan-spread-via.html)
- [Astaroth, Software S0373](https://attack.mitre.org/software/S0373/)
- [Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures](https://thehackernews.com/2026/04/casbaneiro-phishing-targets-latin.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1785