Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil

Astaroth's latest Brazilian-focused campaign (Boto Cor-de-Rosa) combines a Delphi/AutoIt-based banking infostealer with a new Python WhatsApp spreader (zapbiu.py) that harvests contacts, sends malicious ZIPs with an obfuscated VBS downloader, installs an MSI dropper, and exfiltrates contact lists; the report includes technical analysis, propagation and banking module descriptions, numerous file hashes, and at least one contacted domain, with detection noted by Acronis.