Astaroth Trojan Evolves with WhatsApp Web Spambot Component
The Astaroth information-stealing trojan has introduced a new spambot component that leverages WhatsApp Web to spread itself, marking a significant shift in its distribution tactics.
Latin American cybercriminals are continuously refining their malware and attack strategies to bypass security measures and maintain effectiveness. A prime example of this evolution is the Astaroth (also known as Guildma) botnet, which in the fourth quarter of 2025 began deploying a novel WhatsApp Web spambot component. This new capability transforms infected victims into unwitting distributors of the malware by automatically sending messages to every contact in their WhatsApp address book, a departure from its traditional email-based spam campaigns.
The technical analysis reveals that this spambot operates by automating a browser instance in headless mode, effectively stripping away indicators of automation. This allows the entire spam campaign to run without any visible browser window appearing on the victim's screen. Furthermore, the spambot shares significant code similarities with another botnet known as Vareg, which was previously observed distributing other Latin American banking trojans via WhatsApp Web. Identical function and variable names, file delivery logic, and configuration field naming conventions strongly suggest a shared development lineage.
CrowdStrike's research indicates that the Astaroth operators are specifically targeting Brazil. This focus is evidenced by multiple technical indicators, including filtering for Brazilian phone numbers, the use of Portuguese-language spam templates, and specific language-oriented HTTP headers. The Astaroth trojan itself has been active since at least 2015, primarily targeting Brazilian users with a multi-stage infection chain that typically begins with a downloader script, often disguised as a Windows shortcut (LNK) file.
Technically, the spambot component is decrypted using AES in CTS mode, employing the same encryption library Astaroth's developer uses for its core component. The decrypted payload is a 32-bit Delphi Portable Executable. To evade detection, the spambot utilizes a complex, six-stage string obfuscation process previously seen in Astaroth's core component, involving XOR decryption, data reversal, and custom algorithms.
The spambot's configuration file is protected by a custom format that includes a magic word, a Base64-encoded and AES-encrypted configuration, and an HMAC-SHA256 hash for integrity verification. The spambot terminates if this integrity check fails. Once decrypted, the configuration file provides parameters such as enabling/disabling the spambot, headless browser execution flags, delays between messages, and lists of greetings, message bodies, and download URLs for Astaroth downloader components.
The spamming process begins with the download of a browser WebDriver, such as those for Chrome or Edge, which is essential for automating browser instances and establishing a WhatsApp Web session. The spambot then copies the victim's browser profile directory to a temporary location, allowing it to spawn a new browser instance with access to sensitive data like cookies and credentials. The WebDriver is executed in a hidden window, operating on a random port to manage the WhatsApp Web session.
This expansion into using social messaging platforms for distribution represents a significant tactical shift for Astaroth, moving beyond traditional email-based spam. By leveraging a trusted platform like WhatsApp and employing stealthy automation techniques, the threat actors aim to increase their reach and bypass conventional security filters more effectively. The shared codebase with other spambots also suggests a potential consolidation or collaboration within the Latin American eCrime ecosystem.