Astaroth Botnet Deploys New WhatsApp Web Spambot Component

The Astaroth botnet, also known as Guildma, has evolved its capabilities by integrating a new spambot component since Q4 2025. This component is designed to turn infected victims into unwitting distributors of the malware by automating message delivery via WhatsApp Web. Primarily targeting Brazil-based users, the spambot operates by running a browser instance in headless mode, using WebDriver, and actively stripping automation indicators to avoid detection. The infection chain typically starts with a downloader script, often a malicious Windows shortcut (LNK) file executing JScript, followed by an AutoIt-based loader and a Delphi-based loader DLL that executes Astaroth's core components in memory. This development signifies a significant shift from traditional email-based spam propagation to leveraging trusted social messaging platforms, highlighting the evolving tactics of Latin American eCrime groups.

Attack Chain

1. Initial access is gained when a victim executes a downloader script component, often a malicious Windows shortcut (LNK) file running JScript code.
2. The JScript code retrieves an installer component from a command and control (C2) server.
3. The installer executes an AutoIt-based loader.
4. The AutoIt loader decodes and executes a Delphi-based loader DLL directly in memory, an evasion technique.
5. The Delphi DLL further decrypts and executes Astaroth's core component, which includes the new spambot functionality.
6. The spambot copies the victim's browser user data to a temporary directory, typically C:\Users\Public\Temp\ChromeAuto_<BROWSER_ID><DATE>.
7. It then launches a browser instance, such as Google Chrome or Microsoft Edge, in headless mode, actively stripping WebDriver automation indicators to avoid detection.
8. The spambot accesses WhatsApp Web, collects contact lists from the victim's account, and automatically sends malware distribution messages to all contacts, often utilizing Portuguese-language spam templates.

Impact

Successful attacks transform victims' systems into unwilling participants in the botnet's distribution efforts, leading to further spread of the Astaroth banking trojan and information stealer. The direct impact on the initial victim includes potential banking fraud, data exfiltration, and compromised system integrity. The new spambot component enables a wider and more credible distribution vector by leveraging trusted social networks, increasing the potential number of infected users, particularly within Brazil. This tactic bypasses traditional email security measures and capitalizes on social trust, making detection and prevention more challenging.

Recommendation

• Deploy the Sigma rule "Detect Astaroth Spambot Browser User Data Directory Creation" to your SIEM for timely detection of malicious temporary directory creation.
• Block the command and control domains listed in the IOC table at your network perimeter via DNS resolvers or proxy servers.
• Implement the provided YARA rule to scan endpoints and identify the Astaroth spambot component.
• Ensure Sysmon and other endpoint detection and response (EDR) solutions are configured to log file_event (specifically DirectoryCreate operations) and process_creation events to enable rule effectiveness.