In short: Researchers at CrowdStrike and Acronis have detailed a new module in the Astaroth banking trojan that abuses an already-open WhatsApp Web session on an infected Windows PC to send malware to the victim's entire contact list automatically. Each contact gets a friendly greeting and a ZIP archive that, once opened, infects the next machine — so the message arrives from someone you actually know. The campaign is focused on Brazil for now, but the technique is portable. The one rule that stops it: never open an unexpected ZIP sent over WhatsApp, even from a trusted contact.
What happened
Astaroth (also known as Guildma) is a long-running Windows banking trojan. In a report published on 31 July 2026, CrowdStrike described a self-spreading worm component that criminals bolted onto it in late 2025 and have since refined — a campaign that Acronis Threat Research Unit tracks under the name Boto Cor-de-Rosa. The novelty is not the credential theft, which Astaroth has always done, but the delivery: the malware now spreads itself through WhatsApp with no help from the attacker after the first infection.
That self-propagation is what makes it dangerous. Because the malicious message is sent from a real, already-infected account, it lands with the implicit trust of a known sender — the same social-engineering leverage we described in our coverage of malware abusing WhatsApp to leak data. A link or file from a stranger gets ignored; the identical file from a friend gets opened.
How the WhatsApp worm works
Once Astaroth is running on a Windows machine, its worm module does not use WhatsApp's official API. Instead it quietly hijacks the browser the victim is already logged into:
The malware downloads a legitimate Selenium-compatible WebDriver via PowerShell, then clones the user's Chrome or Edge profile into a folder such as C:\Users\Public\Temp\ChromeAuto_<id>. It launches that copy as a headless (invisible) browser and, using the open-source WPPConnect/WA-JS library, connects to the victim's authorised WhatsApp Web session. From there it reads the full contact list and sends each contact three messages: a time-appropriate greeting, a ZIP archive containing the Astaroth loader, and a short follow-up line. The text is randomised to slip past spam filters, and the bot even reports back how many messages were delivered, how many failed, and the send rate.
The infection chain inside the ZIP is the familiar one: an archive hides a script (a Visual Basic or LNK dropper) that pulls down and runs the Delphi-based payload, while the worm module itself is written in Python. No zero-day exploit is involved — the whole scheme runs on the victim opening a file and on an already-logged-in WhatsApp session.
What is at risk
Astaroth's core purpose is financial theft. Its banking module sits quietly in the background and watches which sites you visit; when you open an online-banking or payment page, it activates to capture your login, and on some targets overlays fake windows to grab one-time codes. Anyone whose PC is infected risks having their bank credentials and session harvested. On top of that, the victim unwittingly becomes a spreader, blasting the loader to friends, family and colleagues — turning one compromised laptop into dozens of new targets.
Who does this affect, and what are the warning signs?
For now the campaign overwhelmingly targets Brazil, with more than 95% of infections there and only scattered cases elsewhere, including the United States and Austria. But self-spreading WhatsApp worms are a technique other groups copy quickly, and the same abuse of an open WhatsApp Web session works in any country. Given how widely WhatsApp is used, it is worth understanding the pattern now rather than after it arrives.
Technical warning signs on a Windows PC include a WebDriver being fetched through PowerShell, unexpected ChromeAuto_ folders under C:\Users\Public\Temp, a copy of Chromium running in headless mode, and processes touching WPPConnect components. For ordinary users the tell-tale sign is simpler: friends replying that you sent them a strange archive you never sent.
How to protect your devices and data
Never open an unexpected ZIP over WhatsApp — even from a contact you trust. This is the single control that breaks the chain. If a friend sends an archive out of the blue, ask them (by voice or a separate channel) before opening it.
Keep antivirus and your operating system updated. Reputable security software flags the PowerShell-and-WebDriver behaviour Astaroth relies on. Do not run scripts (.vbs, .lnk, .bat) that arrive in a chat.
Protect your money separately. Turn on two-factor authentication and transaction confirmations in your banking app, so a stolen password alone is not enough to move funds.
Mind the network layer too. A VPN does not stop a file you open yourself — only caution and antivirus do that. But when you bank or log in from café, airport or hotel Wi-Fi, a no-logs VPN encrypts your traffic so no one on the same network can intercept the credentials and codes you send. LiMP VPN is a no-logs service for iOS and Android — see the features and plans, with more security news on our blog.
Sources
This report is based on the 31 July 2026 analysis reported by Anti-Malware.ru (citing CrowdStrike) and technical reporting by The Hacker News (citing Acronis Threat Research Unit), which named the Boto Cor-de-Rosa campaign.