Astaroth Spambot - Hidden Headless WebDriver Automation

Georg Lauenstein@gsec

•updated 18 days ago•0•0•2

Detects a Chrome/Edge WebDriver process launched with headless and automation-hiding command-line flags (--headless combined with --disable-infobars or excludeSwitches enable-automation/test-type). Astaroth's spambot component uses this exact flag combination to drive a hidden browser instance against an active WhatsApp Web session, sending spam to every Brazil-based contact without ever displaying a window to the victim.