MalwarePublished 8 Jan 2026

Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil

Source AlienVault OTX General

Description

The Boto Cor-de-Rosa campaign reveals Astaroth's new strategy of exploiting WhatsApp Web for propagation. This Brazilian banking malware now uses a Python-based worm module to retrieve victims' WhatsApp contact lists and automatically send malicious messages, expanding its infection reach. The attack begins with a malicious ZIP file sent via WhatsApp, containing a Visual Basic script that downloads additional components. The malware then operates two parallel modules: a propagation module for spreading through WhatsApp contacts, and a banking module for credential stealing. This campaign demonstrates Astaroth's evolution, combining traditional malware techniques with sophisticated social engineering and multi-platform propagation, primarily targeting Brazilian users.

Impact

For European organizations, the Boto Cor-de-Rosa campaign poses a moderate risk primarily through social engineering attacks targeting employees who use WhatsApp Web, especially those with contacts in Brazil or who receive messages from Brazilian numbers. Successful infections can lead to credential theft, potentially compromising corporate banking accounts or personal financial information. The worm-like propagation increases the risk of rapid spread within organizations if multiple users are connected via WhatsApp contacts. This could result in data breaches, financial fraud, and reputational damage. Additionally, the use of Visual Basic scripts and Python modules may evade some traditional endpoint defenses if not properly configured. The campaign’s reliance on user interaction means phishing awareness is critical. European companies with subsidiaries or business relations in Brazil, or with a workforce that frequently communicates with Brazilian contacts, are at heightened risk. The campaign also highlights the need to monitor and control the use of web-based messaging platforms in corporate environments to prevent lateral propagation of malware.

Defensive guidance

1. Conduct targeted user awareness training focusing on the risks of opening unsolicited attachments received via WhatsApp or other messaging platforms, emphasizing the danger of ZIP files and scripts. 2. Restrict or monitor the use of WhatsApp Web on corporate devices, potentially disabling it where not essential. 3. Deploy endpoint detection and response (EDR) solutions capable of detecting script execution, especially Visual Basic scripts and Python-based payloads. 4. Implement network monitoring to identify unusual WhatsApp Web traffic patterns or automated message sending behaviors. 5. Enforce strict email and messaging attachment policies that block or quarantine ZIP files containing scripts. 6. Use multi-factor authentication (MFA) on all banking and critical accounts to reduce the impact of credential theft. 7. Regularly update and patch all systems, even though no specific patches exist for this malware, to reduce the attack surface. 8. Encourage employees to verify unexpected messages from contacts, especially those requesting to open attachments or links. 9. Segment networks to limit lateral movement if an infection occurs. 10. Collaborate with threat intelligence providers to stay updated on evolving Astaroth tactics and indicators of compromise.

Indicators of compromise

Domains 4

centrogauchodabahia123.com
coffe-estilo.com
empautlipa.com
miportuarios.com

Hashes 34

1495a3b85b7019f70fad4aa8802a01d3
1dd519a59eb8ab76c8a9f5363df3cf26
2a84a809ab767f554377f2fc4e6cd9c9
45027d8ea53921b59c70c38d90dd8c14
71c0973acf67404f7afb97ffe35b78ab
71d7897f604430b0376f1e41e1aef569
db0eab25b047f82a4644b3b86767a1aa
28182389481679525f108b69c92e43724bb25fda
29ebad781c64cfada12ef4c231761755f393a5b6
2c104871ad0aa37076f124804a9d4420e8dbfc4b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Jan 2026, 09:42 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 34

Community reviews

Related threats