Product
high
threat
Astaroth Botnet Deploys New WhatsApp Web Spambot Component
1 rule 9 TTPs 8 IOCsOperators of the Astaroth (aka Guildma) botnet, which targets Brazil-based users, introduced a new spambot component in Q4 2025 that leverages WhatsApp Web in headless browser mode for malware distribution, exhibiting evasion techniques like payload encryption and WebDriver automation indicator stripping.
Windows +5
Astaroth
botnet
malware
spambot
latin-america
1r
9t
8i
updated
high
advisory
TCLBanker Banking Trojan Self-Spreads via WhatsApp and Outlook
2 rules 8 TTPsTCLBanker is a banking trojan targeting 59 financial platforms, spreading via trojanized Logitech AI Prompt Builder installers and worm modules for WhatsApp and Outlook, enabling remote control and data theft.
AI Prompt Builder +3
banking-trojan
malware
worm
self-spreading
brazil
logitech
2r
8t