Executive Summary
In Q4 2025, operators of the Astaroth (aka Guildma) botnet introduced a novel WhatsApp Web spambot component, signaling a strategic shift from traditional email phishing to social messaging platforms. This component automates victim accounts to send malicious ZIP files to their entire contact list, leveraging the inherent trust of social networks. Technical analysis reveals a high degree of code overlap with the 'Vareg' spambot, suggesting a consolidation of developmental resources within the LATAM eCrime ecosystem.
The attack utilizes headless browser automation and legitimate libraries like WPPConnect/WA-JS to operate invisibly on the victim's machine. By specifically targeting Brazil-based phone numbers and using Portuguese-language templates, the threat actors demonstrate a focused intent to compromise regional financial credentials. This expansion increases the infection velocity and success rate by bypassing traditional email security filters.