Astaroth banking Trojan spreads in Brazil via WhatsApp worm

Astaroth's recent 'Boto Cor‑de‑Rosa' campaign in Brazil uses malicious ZIPs sent via WhatsApp to deploy an obfuscated VBScript downloader that installs both a Delphi-based banking trojan and a Python-based WhatsApp worm. The worm harvests contacts and auto-sends infected ZIPs with localized Portuguese lures while a background banking module monitors browsing and steals credentials; the report includes IoCs and highlights the campaign's social-engineering propagation and multi-language, modular toolset.