Acronis

WhatsApp Exploit Used to Distribute Astaroth Banking Trojan in Brazil

First seen 9 Jan 2026, 20:34 UTC • Acronis

•60% similarity •48.7

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Attackers have compromised Brazilian users through WhatsApp by distributing a malicious ZIP file containing a Visual Basic script that installs the Astaroth banking trojan. This campaign, named Boto-Cor-de-Rosa, utilizes a Python-based propagation module and initiates the infection when victims open the disguised script within the ZIP archive.

ThreatCluster AI How this analysis works

Attack Flow

13 entities, 11 inferred relationships (STIX 2.1).

Technique (3)

Malware
Trojan
Worm

Campaign (3)

Astaroth Campaign
Boto-Cor-de-Rosa
Boto-Cor-de-Rosa Campaign

Malware (1)

Astaroth

Affected Platform (1)

Tool (5)

Python
Python-based Propagation Module
VBS Downloader
Visual Basic Script
Zapbiu.py

Relationships

Astaroth Campaign uses Astaroth
Boto-Cor-de-Rosa uses Astaroth
Boto-Cor-de-Rosa Campaign uses Astaroth
Malware targets WhatsApp
Trojan targets WhatsApp
Worm targets WhatsApp
Astaroth Campaign related to Python
Astaroth Campaign related to Python-based Propagation Module
Astaroth Campaign related to VBS Downloader
Astaroth Campaign related to Visual Basic Script
Astaroth Campaign related to Zapbiu.py

Community

Browse all →

Tracked Entities in This Story

Astaroth Astaroth Campaign Boto-Cor-de-Rosa Boto-Cor-de-Rosa Campaign WhatsApp

WhatsApp Exploit Used to Distribute Astaroth Banking Trojan in Brazil

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story