Astaroth Trojan Reemerges as Boto-Cor-de-Rosa via WhatsApp in Brazil

First seen 10 Jan 2026, 20:46 UTC • Webpronews

•45

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Astaroth banking trojan has resurfaced, now spreading through WhatsApp in Brazil under the name 'Boto-Cor-de-Rosa' or 'Pink Dolphin.' This campaign utilizes worm-like tactics to target users and steal financial data, leveraging the popularity of the messaging app for distribution.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

13 entities, 13 inferred relationships (STIX 2.1).

Technique (3)

Malware
Trojan
Worm

Campaign (2)

Boto-Cor-de-Rosa
Pink Dolphin

Indicator (1)

offseq.com

Malware (1)

Astaroth

Affected Platform (2)

WhatsApp
Windows

Tool (4)

WhatsApp Web
Bitsadmin
Python
Regsvr32

Relationships

Astaroth communicates with offseq.com
Boto-Cor-de-Rosa uses Astaroth
Pink Dolphin uses Astaroth
Malware targets WhatsApp
Malware targets Windows
Trojan targets WhatsApp
Trojan targets Windows
Worm targets WhatsApp
Worm targets Windows
Boto-Cor-de-Rosa related to WhatsApp Web
Boto-Cor-de-Rosa related to Bitsadmin
Boto-Cor-de-Rosa related to Python
Boto-Cor-de-Rosa related to Regsvr32

Continue Reading

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies MuddyWater Targets U.S. Entities Amid Geopolitical Tensions Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers Armored Likho Expands Cyber-Espionage with New Rust Toolkit Guildma (Astaroth) Malware Infection via Geofenced Brazilian Email WhatsApp Worm Distributes Astaroth Banking Trojan in Brazil

Astaroth Trojan Reemerges as Boto-Cor-de-Rosa via WhatsApp in Brazil

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading