Session Creation
After launching the WebDriver executable, the spambot initiates a browser instance via custom command-line browser capabilities sent via an HTTP POST
request to the driver's /session
endpoint.2 The driver replies with a unique session ID used to interact with the browser instance.
The Chromium command line includes several capabilities designed to suppress automation indicators, such as:
--headless
: Runs Chrome without a visible user interface (UI)--disable-infobars
: Hides the Chrome is being controlled by automated test software
banner--window-size=1920,1080
: Sets browser screen size (even in headless mode), as some websites check this valueexcludeSwitches: ["enable-automation", "test-type"]
: Removes flags that identify the browser as an automated instance
The Microsoft Edge command line includes analogous capabilities, with additional flags to suppress sync behavior, logging, and default app creation.
WPPConnect/WA-JS Download
Once the Astaroth spambot creates the browser instance, the spambot retrieves a copy of the JavaScript (JS) library WPPConnect/WA-JS — a legitimate library that exports WhatsApp Web functions for customer service automations.3 Astaroth's developer abuses this library to interact with the victim's WhatsApp Web session and gather and spam contacts.
WhatsApp Web Navigation and Verification
After creating the session ID and downloading the JS library, the spambot instructs the automated browser to load WhatsApp Web. Before running its contact grabber functionality, the spambot verifies that one of the following HTML elements exists in the loaded page — highly likely to confirm that the site has fully loaded and that the victim has an active login session:
new-chat-outline
: Button to start a new chatsettings-refreshed
: Button to access settingschat
: Button to view the victim's WhatsApp Web chats
Contact Grabber
After loading the WPPConnect/WA-JS library, the spambot reads the victim's WhatsApp Web contact list by executing a Base64-decoded script. The script performs the following actions:
- Retrieves all contacts by invoking
WPP.contact.getAllContacts
(or WPP.contact.list
if WPP.contact.getAllContacts
is unavailable) - Filters contacts by removing group chats (
@g.us
), broadcast lists (@broadcast
), linked devices (@lid
), phone numbers not starting with the Brazil country code prefix 55
, non-saved contacts, and the victim's own contact - Maps each contact into a list containing the contact’s display name (
nome
), phone number (fone
), and assigned number (numero
)
Spam Payload Retrieval
Before sending spam messages, the spambot downloads an Astaroth payload following this process:
- Randomly selecting a URL from the configuration field
ArrURL
(Table 1) - Replacing a pattern in the selected URL with a random number
- Setting the user agent to a Chrome browser string
- Retrieving a Base64-encoded ZIP file via an HTTP
GET
request
Spamming Contacts
After downloading the payload, the spambot composes and sends spam messages to each collected contact. The process:
- Parses the victim device's current hour to select an appropriate greeting (e.g., good morning, good evening, or good night in Portuguese)
- Randomly selects a greeting from
ArrMSG
and a body message from ArrMF
- Composes a JS script including the targeted contact's phone number, name, selected greeting, and body message
- Prepends the composed JS to a hardcoded Base64-encoded WPP script
- Executes the script via the WebDriver that sends three messages: a greeting, a malware ZIP file attachment, and a body message
Vareg Spambot Overlap
In October 2025 and November 2025, a threat actor leveraged a spambot dubbed Vareg to distribute several LATAM banking trojans — including Astaroth — targeting Brazil-based users. However, Vareg activity ceased in Q4 2025, closely coinciding with the period when the Astaroth botnet began distributing its spambot component.
Over the course of the Vareg spambot’s period of activity, its developer rewrote the PS-based spambot in Python while maintaining its functionality, highly likely in an attempt to avoid detections. Technical analysis reveals that Vareg’s developer likely used AI to implement the malware, as the scripting codes include patterns commonly associated with AI-assisted coding.
Further analysis of the Astaroth spambot and the Vareg spambot's Python and PS versions reveals extensive code overlaps, shown in Table 2.
Table 2. Astaroth and Vareg configuration overlaps| Astaroth's Field | Vareg's Field | Translation | Description |
FCX | filtro_contatos_excluir | Filter to exclude contacts | Filters variable to exclude contacts |
LT | limite_teste | Limit test | Sets a threshold for the maximum number of users to spam |
HL | modo_headless | Headless mode | Enables headless browser mode |
DEL | delay_entre_mensagens | Delay between messages | Defines the delay in milliseconds between consecutive spam messages |
ArrMSG | mensagem_saudacao | Greeting message | Specifies the selected greeting for the spam message |
ArrMF | mensagem_final | Final message | Specifies the selected body for the spam message |
The overlapping code between Astaroth and Vareg includes identical message delivery implementations with the same function and variable names, including enviarParaContato
and mensagemSaudacao
. Both spambots implement the same contact-grabber logic to filter non-valid contacts, with the Astaroth spambot adding an additional check to filter out non-Brazil-based phone numbers. Both spambots also implement identical delay logic — with Astaroth’s delay implemented in Delphi and Vareg's delay implemented in Python — with the same minimum (50 milliseconds) and maximum (200 milliseconds) values.
Assessment
Astaroth's new spambot component marks a major capability expansion for the malware's developer — an established LATAM-focused threat actor — by shifting from traditional email-based spam propagation to leveraging trusted social messaging platforms to enhance the spam messages' apparent credibility and reach a broader set of victims.
The spambot seamlessly integrates into the existing Astaroth infection chain, and reuses the same encryption, obfuscation, and encoding techniques employed in the core component. This suggests the spambot was highly likely developed by the initial Astaroth developer, rather than acquired from or outsourced to another developer. This assessment is made with high confidence based on technical analysis of Astaroth's core component and spambot component.
The code overlap between the Astaroth and Vareg spambots highly likely indicates that the same threat actor developed both spambots or that the actors operating the two toolsets have a code-sharing arrangement. This assessment is made with moderate confidence based on technical analysis of the two spambots and on analysis of campaigns leveraging them during Q4 2025.
Whether Astaroth's operator conducted the October 2025 and November 2025 Vareg campaigns presently remains unknown; however, the cessation of Vareg activity in Q4 2025 — closely coinciding with the date the Astaroth botnet began distributing its spambot component — likely indicates that the Vareg operation was incorporated into Astaroth activity. This assessment is made with low confidence based on limited campaign visibility and the circumstantial nature of the available evidence.
Recommendations
The following recommendations can help protect against the activity described in this report:
- Train users to identify common social engineering techniques such as leveraging phishing emails, inauthentic WhatsApp messages, and fake websites
- Train users to avoid executing files or commands from untrusted sources, including unknown contacts and profiles in messaging applications
- Enable download protections in browser settings to warn users about potentially harmful websites or downloads
- Consider blocking WhatsApp Web when not necessary for business purposes
- Monitor WebDriver downloads via PS into unusual folder destinations, which may indicate a spambot is present within the environment
- Monitor for folder creation activity following the pattern
ChromeAuto_
within C:\Users\Public\Temp\
- Block WebDriver from executing when it is not needed for business purposes
- Monitor for headless browser instances, which may indicate suspicious hidden browser activity
- Monitor downloads and executions of the WPPConnect/WA-JS library from GitHub; consider blocking access to the URL for this library when not needed for business purposes