Inside Astaroth's New Spambot Component

This report details a new Astaroth spambot that leverages automated Chromium/Edge WebDriver instances and the legitimate WPPConnect/WA-JS library to harvest WhatsApp Web contacts in Brazil and deliver Base64-encoded ZIP malware attachments (including LATAM banking trojans). It describes how the spambot creates sessions, verifies WhatsApp Web, filters contacts, retrieves payloads from configurable URLs, and sends multi-part spam messages; analyses show code overlap with the Vareg spambot, suggesting shared development or code reuse, and the report concludes with detection and mitigation recommendations.