The Astaroth malware has introduced a new spambot component designed to exploit WhatsApp Web for automated malware propagation. By utilizing WebDriver to initiate headless browser sessions and the legitimate WPPConnect/WA-JS library, the spambot can bypass automation indicators and interact directly with a victim's active session. It specifically targets Brazil-based contacts, filtering for local numbers before sending malicious ZIP attachments and phishing messages.
Technical analysis reveals a high degree of code overlap between Astaroth and the Vareg spambot, including identical configuration fields and message delivery implementations. This shift from email-based spam to social messaging platforms marks a significant expansion in the threat actor's capabilities, leveraging the inherent trust in messaging apps to increase infection rates. Organizations are advised to monitor for unusual WebDriver activity and consider restrictions on WhatsApp Web in sensitive environments.
Top comments (0)