We often think of malware as something that lurks in the dark corners of the internet, waiting for us to visit a shady website or click on a spam email from a stranger. But the reality of modern cyber threats is far more personal. The latest campaign to hit the cybersecurity radar, dubbed “Boto-Cor-de-Rosa” (Pink River Dolphin), proves just how personal these attacks have become. It creates a scenario where the threat doesn’t come from a faceless hacker, but from your best friend, your colleague, or your family member via a WhatsApp message.
This specific campaign is the latest evolution of Astaroth, a notorious banking trojan that has plagued Brazil for years. While banking malware is nothing new, the delivery method here is what demands our attention. The researchers at the Acronis Threat Research Unit have discovered that Astaroth has added a sophisticated new trick to its arsenal: a worm capability designed specifically to exploit WhatsApp Web.
The infection starts innocently enough. You receive a message on WhatsApp from someone you know. It’s casual, perhaps a bit generic, saying something like “Here is the requested file. If you have any questions, I’m available!” The message includes a ZIP file attachment with a name that looks like a jumble of numbers and codes. Because it comes from a trusted contact, your guard is down. You assume it’s a document or a photo they meant to send.
Once you download and open that ZIP file on your computer, you aren’t greeting a photo; you are executing a Visual Basic script disguised as a harmless file. This script acts as a gatekeeper, quietly downloading the heavy machinery of the attack in the background. This is where the malware splits its focus into two distinct but equally dangerous jobs.
The first job is the traditional theft we associate with banking trojans. A component of the malware installs itself silently and begins monitoring your browsing activity. It sits in the background, waiting for you to visit a banking website or a financial portal. The moment you do, it springs into action, capturing your login credentials and financial data to send back to the attackers. It is a digital pickpocket that waits until you are at the register to strike.
The second job is what gives this campaign its viral nature. The malware installs a Python-based module that takes control of your WhatsApp Web session. It scrapes your entire contact list and begins automatically sending that same malicious ZIP file to your friends and family. It doesn’t just spam them randomly; it uses social engineering to make the messages feel authentic. The malware checks the local time on your computer to choose the correct greeting—”Bom dia” (Good morning), “Boa tarde” (Good afternoon), or “Boa noite” (Good evening)—before sending the file. This small, human touch makes the message feel like a genuine interaction, significantly increasing the chances that your contacts will fall for the trap just as you did.
Technically, the attackers are using a method often called “Living off the Land.” They utilize legitimate tools like the AutoIt interpreter and the Python programming language to run their malicious code. By using trusted, standard software components to do their dirty work, they make it much harder for traditional antivirus programs to flag the activity as suspicious. It is a clever, if devious, way to blend in with normal system operations.
Staying Safe Online Even With Those We Trust
The Boto-Cor-de-Rosa campaign serves as a stark reminder of how our digital trust is being weaponised. The attackers understand that we are conditioned to trust the people in our contact lists implicitly. They are leveraging that psychological blind spot to bypass the scepticism we usually apply to emails from strangers.
To protect yourself, you need to adopt a “zero-trust” mindset, even with friends. If you receive an unexpected file transfer on WhatsApp or any messaging platform, pause. Look at the filename. Does it look like a random string of numbers? Read the message carefully. Does it sound exactly like your friend, or is it a bit generic? The best defense is a simple verification: send a text back asking, “Hey, did you just send me a file?” If they didn’t, you have saved yourself a massive headache.
We need to be more aware of how we interact on these platforms. We treat messaging apps as safe havens for casual conversation, but to a cybercriminal, they are just another vector for infection. By raising our collective awareness and verifying before we click, we can break the chain of infection and keep our devices—and our bank accounts—out of the hands of these digital dolphins.
