Astaroth (Guildma) operators deployed a new WhatsApp Web spambot component in Q4 2025 that uses headless browser automation with stripped WebDriver indicators to silently message all contacts in a victim's WhatsApp list, turning victims into unwitting malware distributors. The spambot shares significant codebase overlap with the Vareg (WATER SACI) spambot previously used to distribute LATAM banking trojans. This represents a shift from traditional email-based spam to abuse of trusted social messaging platforms, with continued Brazil-focused targeting.
headless-browser
1 post
Inside Astaroth's New Spambot Component