WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil in Self-Propagating Campaign

A new and especially dangerous malware campaign is exploiting WhatsApp to spread the notorious Astaroth banking Trojan to Windows systems, primarily targeting users in Brazil in a worm-like infection pattern that leverages victim contact lists to amplify itself. The threat, dubbed Boto Cor-de-Rosa by the Acronis Threat Research Unit, represents an evolution in how banking malware propagates by abusing popular messaging apps to reach more victims and steal sensitive financial credentials.

The use of WhatsApp — one of the most widely used messaging platforms in Brazil — marks a worrying shift in malware distribution tactics, as threat actors exploit both the trust users place in message content from friends and family and the automation capabilities offered by modern scripting to spread malicious payloads quickly.

Astaroth: A Long-Standing Banking Trojan With New Tricks

Astaroth, also known by the alias Guildma, is a well-established Windows-based banking malware first observed in the wild around 2015. Over the years, it has been widely deployed in Latin America, particularly Brazil, to siphon credentials, intercept financial transactions, and steal sensitive data from victims’ machines. Traditionally distributed via email phishing and malicious download links, the Trojan’s operators have now added a novel propagation module that turns smartphones and laptops running WhatsApp into unwitting malware relays.

In previous years, variants of Astaroth delivered via phishing emails were tied to cybercriminal clusters such as PINEAPPLE and Water Makara, often embedding malicious scripts inside zipped attachments. But the latest campaign shows a far more aggressive strategy, where the malware spreads automatically through messaging, effectively acting like a worm — spreading laterally from one infected device to others based on WhatsApp contacts.

The Acronis report on Boto Cor-de-Rosa reveals that while the core malware remains in Delphi (a programming language often associated with legacy Windows applications), its worm propagation logic is now Python-based, demonstrating a multi-language modular architecture where different parts of the malware are written in the best tools for their respective tasks.

How the Boto Cor-de-Rosa Campaign Works

1. Infection Vector: WhatsApp Messages With Malicious ZIP Files

The campaign begins when a user receives a WhatsApp message containing a ZIP archive — often appearing to be a benign attachment. Inside the ZIP file, a Visual Basic Script (VBS) is disguised as an innocuous file. When the user extracts and executes this script, it triggers the next stage of the compromise.

Executing the VBS script begins by downloading additional components:

• A Python-based worm module that handles propagation
• A banking module that embeds the core Astaroth malware

This multi-part delivery mechanism bypasses many common defenses, as the initial step resembles harmless script execution rather than a clear malware drop.

2. Automatic Propagation Via WhatsApp Contacts

Once the malware is on a victim’s machine, it extracts the user’s WhatsApp contact list and automatically sends each contact a new malicious message containing a fresh ZIP archive. This step effectively repurposes a trusted communication platform into a malware distribution network.

Because the propagation component runs in the background without user intervention, infections can spread rapidly through social and professional networks — particularly in regions where WhatsApp usage is extremely high, such as Brazil.

The Python-based module is engineered to operate like a worm, harvesting contacts and systematically replicating the malicious payload to each one, maximizing the reach of the attack and sustaining infection chains without additional effort from threat operators.

3. Banking Trojan Operational Behavior

After propagation begins, the banking Trojan component runs quietly in the background. It continuously monitors the victim’s web browsing activity and specifically watches for URLs associated with online banking portals or financial services. When such a URL is detected, the malware activates its credential-stealing routines.

These routines can include:

• Keylogging to capture typed credentials
• Injecting malicious scripts into banking pages
• Overlaying fake login prompts to intercept data
• Exfiltrating data to remote servers controlled by attackers

The goal, in every case, is to harvest login data that can be used to siphon funds or sell access on underground markets.

Why WhatsApp Is a Vital Distribution Vector

Using WhatsApp as the attack surface provides several advantages for threat actors:

Trust Factor in Personal Messaging

Messages sent via WhatsApp from a known contact carry greater perceived legitimacy than a generic email from an unknown sender. Recipients are far more likely to open attachments when they believe they came from someone they trust.

Bypassing Email and Web Filters

Traditional cybersecurity defenses, such as email scanning and web filters, are optimized for monitoring enterprise email traffic and browser activity. Messaging apps — especially those relying on end-to-end encryption — often fall outside the purview of these defenses.

Widespread Adoption in Target Regions

Brazil continues to be one of the largest markets for WhatsApp globally, making it an attractive target for threat actors focusing on both financial fraud and credential theft. Widespread local adoption means more potential hosts for self-propagating malware campaigns.

This campaign’s heavy focus on Brazilian victims — more than 95% of infections reported there — underscores how attackers are tailoring their methods to local technology habits.

Sophistication and Modular Malware Architecture

An important aspect of Boto Cor-de-Rosa is the way it combines multiple languages and technologies:

• Delphi – Used for the core banking malware
• Visual Basic Script – Acts as the installer or dropper
• Python – Powers the WhatsApp worm functionality

This modularity allows the malware to evolve over time, update components independently, and evade detection by static signature-based defenses that might flag a single language variant but miss multi-stage, multi-language threats.

The use of Python for the propagation module, in particular, signals a greater reliance on high-level scripting languages that can interface with messaging platforms via automation or remote APIs, broadening the attack’s reach.

Comparisons to Other Messaging-Based Malware Trends

The Boto Cor-de-Rosa campaign is part of a growing pattern of malware leveraging messaging apps for distribution and propagation. Other campaigns observed in the past year also illustrate similar techniques:

• The Water Saci campaign used WhatsApp Web to automate the spread of a banking trojan via HTML Application (HTA) and PDF lures that ultimately dropped malicious scripts and MSI installers.
• Earlier experiments marketing a fake WhatsApp API library on npm were discovered that harvested credentials, contacts, and session tokens when installed by developers.

These trends highlight that threat actors see messaging platforms as effective malware vectors because users inherently trust communications received there and because traditional defenses are less effective at filtering malicious content on these platforms.

Real-World Impact and Risks

The combination of a self-propagating worm mechanism and a banking Trojan payload poses several severe risks:

Rapid Spread Through Trusted Networks

Malware that self-replicates across WhatsApp contact lists can propagate fast — similar to biological worms — because every infected device becomes a distribution hub.

Business and Financial Losses

Captured banking credentials and active session hijacks can lead to unauthorized transfers, drained accounts, and significant financial loss, especially in regions where online banking is widespread.

Dangerous Operational Persistence

Once the malware reaches a machine, it can remain dormant until it detects financial activity, making it stealthy and difficult to spot without specialized endpoint detection tools.

Evading Detection and Analysis

Multi-language modular malware presents challenges for detection because static analysis tools may miss components, and dynamic monitoring may not correlate the propagation component with the financial theft payload.

How Users and Organizations Can Protect Themselves

Preventing infection from campaigns like Boto Cor-de-Rosa requires layered defenses and heightened user awareness:

1. Avoid Opening Suspicious Attachments

Even if a message comes from a trusted contact, users should verify unexpected ZIP files or scripts before opening them. This is especially important when messages reference downloads, documents, or executable content.

2. Keep Systems Updated

Install operating system updates and security patches promptly, as up-to-date systems reduce the risk of exploitation by malware that relies on known vulnerabilities.

3. Use Reliable Security Software

Endpoint protection platforms with behavioral detection can help identify unusual activity, such as automatic contact harvesting or scripting engines attempting to send messages.

4. Educate Users About Messaging Threats

Awareness programs should include training on the risks associated with attachments received via messaging apps, emphasizing skepticism and verification.

5. Monitor for Unusual WhatsApp Activity

Users should check for unexpected WhatsApp message sends or changes in account behavior, especially on devices shared between mobile and desktop environments.

Conclusion: Messaging Apps as the New Malware Frontline

The Boto Cor-de-Rosa campaign marks a worrying evolution in banking malware delivery. By combining a self-propagating WhatsApp worm with a mature credential-stealing Trojan, threat actors are showing that messaging platforms are now legitimate distribution vectors for complex malware — capable of both rapid spread and significant financial impact.

For users and organizations in Brazil and beyond, this trend underscores the importance of hardening defenses, raising user awareness, and monitoring for anomalous messaging activity that could be an early sign of compromise. As attackers continue to innovate with multi-language modules and automated propagation, defenders must adapt their strategies accordingly to keep pace with these emerging threats.