The Boto Cor-de-Rosa campaign reveals a new propagation strategy by the Astaroth banking malware family, leveraging WhatsApp Web as a vector for spreading a Python-based worm module. The infection chain begins when a victim receives a malicious ZIP file via WhatsApp containing a Visual Basic script. When executed, this script downloads additional malware components that enable two parallel operations: a propagation module that automatically retrieves the victim's WhatsApp contact list and sends the malicious ZIP file to those contacts, and a banking module designed to steal credentials from infected systems. This dual-module approach allows the malware to rapidly expand its reach through social engineering tactics, exploiting the trust inherent in WhatsApp communications. The use of WhatsApp Web is notable because it enables the malware to operate across platforms where WhatsApp is accessed via browsers, increasing its attack surface. The campaign primarily targets Brazilian users, reflecting Astaroth's historical focus on Brazilian banking institutions and users. The malware employs multiple advanced techniques, including code obfuscation, script execution, and multi-stage payload delivery, to evade detection and maintain persistence. Despite its sophistication, the campaign requires user interaction to open the malicious ZIP file, limiting its automatic spread. No CVEs or patches are currently associated with this threat, and no known exploits are reported outside this campaign. The campaign underscores the evolving threat landscape where traditional banking malware integrates social media and messaging platforms for propagation.

For European organizations, the Boto Cor-de-Rosa campaign poses a moderate risk primarily through social engineering attacks targeting employees who use WhatsApp Web, especially those with contacts in Brazil or who receive messages from Brazilian numbers. Successful infections can lead to credential theft, potentially compromising corporate banking accounts or personal financial information. The worm-like propagation increases the risk of rapid spread within organizations if multiple users are connected via WhatsApp contacts. This could result in data breaches, financial fraud, and reputational damage. Additionally, the use of Visual Basic scripts and Python modules may evade some traditional endpoint defenses if not properly configured. The campaign’s reliance on user interaction means phishing awareness is critical. European companies with subsidiaries or business relations in Brazil, or with a workforce that frequently communicates with Brazilian contacts, are at heightened risk. The campaign also highlights the need to monitor and control the use of web-based messaging platforms in corporate environments to prevent lateral propagation of malware.

1. Conduct targeted user awareness training focusing on the risks of opening unsolicited attachments received via WhatsApp or other messaging platforms, emphasizing the danger of ZIP files and scripts. 2. Restrict or monitor the use of WhatsApp Web on corporate devices, potentially disabling it where not essential. 3. Deploy endpoint detection and response (EDR) solutions capable of detecting script execution, especially Visual Basic scripts and Python-based payloads. 4. Implement network monitoring to identify unusual WhatsApp Web traffic patterns or automated message sending behaviors. 5. Enforce strict email and messaging attachment policies that block or quarantine ZIP files containing scripts. 6. Use multi-factor authentication (MFA) on all banking and critical accounts to reduce the impact of credential theft. 7. Regularly update and patch all systems, even though no specific patches exist for this malware, to reduce the attack surface. 8. Encourage employees to verify unexpected messages from contacts, especially those requesting to open attachments or links. 9. Segment networks to limit lateral movement if an infection occurs. 10. Collaborate with threat intelligence providers to stay updated on evolving Astaroth tactics and indicators of compromise.