Hijacked WhatsApp Accounts Send Astaroth ZIP Payloads to Trusted Contacts

Astaroth operators have expanded the banking trojan’s delivery methods by abusing WhatsApp Web to send malicious ZIP files to victims’ trusted contacts automatically. The newly identified capability turns an infected user’s WhatsApp account into a spam distribution channel, increasing the credibility and reach of Astaroth campaigns targeting Brazil. Astaroth, also known as Guildma, is a long-running Latin American banking trojan and information stealer active since at least…