Astaroth Trojan Hijacks WhatsApp Web Sessions to Spread Banking Malware to Contacts
The operators of the banking Trojan Astaroth, also known as Guildma, have equipped infected Windows machines with the ability to autonomously distribute malicious archives through WhatsApp Web. Victims now face not only the risk of banking data theft but also the possibility of unknowingly forwarding the Trojan to their own contacts, according to researchers at CrowdStrike.
Previously, Astaroth spread mainly through phishing emails. In late 2025 the operators added a dedicated spam module for WhatsApp Web. The module copies the profile of Chrome or Edge, downloads the official WebDriver, and launches the browser in headless mode. It then attaches to an already authenticated WhatsApp Web session using the legitimate WPPConnect/WA-JS library.
From the user’s perspective the process remains silent. In the background the bot iterates through the address book and sends three messages to every contact: a time-appropriate greeting, a ZIP archive containing the Astaroth loader, and a closing text. Links and wording are randomized to avoid pattern-based detection.
Because the messages arrive from a known person and begin with natural phrases such as “good morning,” recipients are far more likely to open the attachment. The spam-bot code shares structural and functional traits with tools used by other Latin American groups, including Vareg, indicating either a common developer or active sharing of components within the regional cybercrime ecosystem.
Observable signs of infection include PowerShell downloads of WebDriver, the appearance of ChromeAuto_ folders under C:\Users\Public\Temp, headless Chromium processes, and network connections to WPPConnect components. Astaroth has effectively turned WhatsApp Web into a delivery service for its banking payload, with the victim unknowingly covering the distribution costs.
Related articles
Researchers Create 0-Click WeChat Worm That Hijacks Accounts via Incoming Calls
Security researchers at Calif have developed a 0-click worm capable of compromising WeChat accounts through incoming voice calls without any user interaction. The exploit requires only that the attacker already exists in the victim's contact list and works across Android and iOS devices. In demonstrations, an infected Android device called an iPhone to seize control of its WeChat account while the call continued ringing, after which the compromised iPhone targeted another Android device. The worm spreads automatically between trusted contacts, functioning like a classic network worm but using WeChat profiles as propagation nodes. Even if the victim answers or declines the call, the exploit can persist or be retried, for example during nighttime hours. After account takeover, attackers gain full control to read and send messages, make calls, and impersonate the owner, while the underlying smartphone itself remains unaffected. Tencent received notification in July, released patches in versions 8.0.77 for Android and 8.0.76 for iOS, and server-side blocking was confirmed by late August, with no real-world attacks observed so far.
Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The article traces the author's journey starting in 2020 when anomalous traffic from social networks began flooding websites, initially appearing as visits from Twitter, Instagram, YouTube, and VKontakte. Early attempts using .htaccess rules to block referrers failed as bots dynamically switched to direct or external domain transitions. Server-side JavaScript and cookie checks altered bot behavior but did not stop the flow, revealing that successful browser checks only confirm technical capability rather than human presence. IP blocking of ranges like 31.173.80.0/21 and 178.176.64.0/19 provided temporary relief until mobile proxies rotated addresses, exposing the limits of static blacklists. IPv6 adoption further demonstrated how address-family-specific rules quickly become obsolete. Fingerprint spoofing and constant rotation of digital prints made single-signal identification unreliable. The core lesson emphasizes real-time filtering at the edge over post-hoc analytics exclusion to prevent bots from reaching the web server at all.
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.
Attackers Abuse Legitimate Node.js Runtime to Deploy Persistent Malware in Targeted Operations
Cybercriminals are increasingly misusing the legitimate Node.js runtime to execute malicious JavaScript scripts and maintain persistence on corporate networks. The technique has been observed since February 2026 against governments, technology firms, hotels, and financial organizations. Attackers favor the signed node.exe binary to evade signature-based detections after initial access via ClickFix social engineering. In one case against an Asian technology company, Node.js was deployed following blocked attempts to install AdaptixC2 and Cobalt Strike. The resulting implant establishes registry persistence and communicates with Ethereum blockchain gateways to retrieve commands hidden in smart contracts. The approach has been linked to multiple tools including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer, with some campaigns attributed to the initial-access broker Woodgnat, also known as KongTuke.