Vareg

Astaroth Trojan Hijacks WhatsApp Web Sessions to Spread Banking Malware to Contacts

The operators of the Astaroth banking Trojan, also known as Guildma, have added a new module that turns infected Windows systems into automated spam bots for WhatsApp Web. The malware copies browser profiles from Chrome or Edge, launches a legitimate WebDriver instance, and connects to an already authenticated WhatsApp Web session using the WPPConnect/WA-JS library. Once active, the bot scans the victim's contact list and sends each recipient a personalized greeting, a ZIP archive containing the Astaroth loader, and a closing message, all generated with randomized phrasing to evade detection. The technique leverages the trust users place in messages from known contacts, significantly increasing the likelihood of successful infection. Researchers at CrowdStrike note code similarities with tools used by other Latin American groups, including Vareg, suggesting shared development or active exchange of components. Indicators of compromise include PowerShell downloads of WebDriver, creation of ChromeAuto_ folders in C:\Users\Public\Temp, headless Chromium execution, and network activity tied to WPPConnect components.