WhatsApp compromise leads to Astaroth deployment

A malware campaign targeting WhatsApp users primarily in Brazil uses WhatsApp's 'View Once' message feature to deliver malicious ZIP archives containing VBS or HTA files. These files execute PowerShell scripts to download additional payloads, including scripts that steal WhatsApp user data and an MSI installer deploying the Astaroth banking trojan. The campaign evolved from IMAP-based to HTTP-based command and control communication and leverages Selenium Chrome WebDriver and the WPPConnect JavaScript library to hijack WhatsApp Web sessions, steal session tokens and contacts, and distribute spam. Over 250 victims have been identified, with 95% located in Brazil and some impact noted in Austria. The attack enables credential theft, session hijacking, persistence, and financial fraud through banking trojan deployment. No CVE or known exploits in the wild are reported, and the campaign is rated medium severity. Defenders should focus on user awareness, endpoint detection of PowerShell and script execution, and monitoring for suspicious WhatsApp Web activity.

• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser TheftMalware2026-09-24
• LiteLLM supply chain compromiseCampaign2026-10-22
• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageCampaign2026-10-21