Sophos analysts are investigating a persistent, multi-stage malware distribution marketing campaign concentrating on WhatsApp customers in Brazil. First noticed on September 24, 2025, the marketing campaign (tracked as STAC3150) delivers archive attachments containing a downloader script that retrieves a number of second-stage payloads. In early October, Counter Menace Unit\u2122 (CTU) researchers detailed<\/a> exercise related to a separate Brazil-based marketing campaign wherein the menace actors leveraged WhatsApp to deploy the Maverick banking trojan for credential theft.<\/p>\n

In STAC3150, the second-stage payloads embrace a script that collects WhatsApp contact info and session information, and an installer that deploys the Astaroth (also called Guildma) banking trojan (see Determine 1). $\"Diagram$ <\/a>Determine 1: Assault chain within the WhatsApp STAC3150 marketing campaign<\/em><\/p>\n

Assault development<\/h3>\nThe assaults begin with a message that’s despatched utilizing the WhatsApp \u201cView As soon as\u201d choice (see Determine 2). $\"WhatsApp$ <\/a><\/p>\n
Determine 2: WhatsApp lure (left) and translation (proper)<\/em><\/p>\n
The lure delivers a ZIP archive that accommodates a malicious VBS or HTA file. When executed, this malicious file launches PowerShell to retrieve second-stage payloads, together with a PowerShell or Python script that collects WhatsApp consumer information and, in later instances, an MSI installer that delivers the Astaroth malware. Determine 3 exhibits the modifications in downloader scripts and second-stage information over the course of the marketing campaign.<\/p>\n
$\"Changes$ <\/a><\/p>\n
Determine 3: File codecs used within the STAC3150 marketing campaign between September 24 and October 31, 2025<\/em><\/p>\n
In late September incidents, Sophos analysts noticed PowerShell getting used to retrieve the second-stage payloads through IMAP from an attacker-controlled e-mail account. In early October, the marketing campaign shifted to HTTP-based communication, leveraging PowerShell\u2019s Invoke-WebRequest command to contact a distant command and management (C2) server hosted on https: \/\/www . varegjopeaks . com (see Determine 4).<\/p>\n
$\"Display$ <\/a><\/p>\n
Determine 4: First-stage PowerShell instructions launched from malicious VBS file<\/em><\/p>\n
The downloaded second-stage PowerShell or Python script (see Determine 5) makes use of the Selenium Chrome WebDriver and the WPPConnect JavaScript library to hijack WhatsApp Net classes, harvest contact info and session tokens, and facilitate spam distribution.<\/p>\n
$\"Extracts$ <\/a><\/p>\n
Determine 5: PowerShell (left) and Python (proper) scripts for WhatsApp information assortment<\/em><\/p>\n
In late October, the second-stage information started to additionally embrace an MSI file (installer.msi) that delivers Astaroth malware. \u00a0The installer file writes information to disk and creates a startup registry key to take care of persistence. When executed, it launches the Astaroth malware through a malicious AutoIt script that masquerades as a .log file (see Determine 6). The malware communicates with a C2 server hosted at manoelimoveiscaioba . com.<\/p>\n
$\"AutoIT$ <\/a><\/p>\n
Determine 6: AutoIt payload execution<\/em><\/p>\n
Victimology<\/h3>\n
Sophos analysts noticed this marketing campaign affecting greater than 250 prospects, with roughly 95% of the impacted gadgets situated in Brazil. The remaining have been situated in different Latin American international locations, the U.S., and Austria (see Determine 7).<\/p>\n
$\"Map$ <\/a><\/p>\n
Determine 7: Distribution of Sophos buyer gadgets impacted by the WhatsApp marketing campaign deploying Astaroth between October 23 and October 28, 2025<\/em><\/p>\n
Suggestions, detections, and indicators<\/h3>\n
Organizations ought to educate staff concerning the dangers of opening archive attachments despatched through social media and on the spot messaging platforms, even when obtained from identified contacts.<\/p>\n
SophosLabs has developed the countermeasures in Desk 1 to detect exercise related to this menace.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Title<\/td>\n Description<\/td>\n<\/tr>\n<\/thead>\n
VBS\/DwnLdr-ADJT<\/td>\n Detection for preliminary VBS file<\/td>\n<\/tr>\n
VBS\/DwnLdr-ADJW<\/td>\n Detection for preliminary VBS file<\/td>\n<\/tr>\n
VBS\/DwnLdr-ADJS<\/td>\n Detection for second-stage VBS file<\/td>\n<\/tr>\n
Troj\/Mdrop-KEP<\/td>\n Detection for second-stage MSI file<\/td>\n<\/tr>\n
Troj\/Mdrop-KES<\/td>\n Detection for second-stage MSI file<\/td>\n<\/tr>\n
Troj\/AutoIt-DJB<\/td>\n Detection for AutoIt payload<\/td>\n<\/tr>\n
Troj\/HTADrp-CE<\/td>\n Detection for HTA script<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Desk 1: Sophos detections related to this menace<\/em><\/p>\n
The menace indicators in Desk 2 can be utilized to detect exercise associated to this menace. The domains might include malicious content material, so contemplate the dangers earlier than opening them in a browser.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Indicator<\/td>\n Kind<\/td>\n Context<\/td>\n<\/tr>\n<\/thead>\n
manoelimoveiscaioba[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
varegjopeaks[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
docsmoonstudioclayworks[.]on-line<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
shopeeship[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
miportuarios[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
borizerefeicoes[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
clhttradinglimited[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n
lefthandsuperstructures[.]com<\/td>\n Area identify<\/td>\n C2 server utilized in WhatsApp STAC3150 marketing campaign<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Desk 2: Indicators for this menace<\/em><\/p>\n<\/p><\/div>\n\n","protected":false},"excerpt":{"rendered":"
Sophos analysts are investigating a persistent, multi-stage malware distribution marketing campaign concentrating on WhatsApp customers in Brazil. First noticed on September 24, 2025, the marketing campaign (tracked as STAC3150) delivers archive attachments containing a downloader script that retrieves a number of second-stage payloads. In early October, Counter Menace Unit\u2122 (CTU) researchers detailed exercise related to […]<\/p>\n","protected":false},"author":2,"featured_media":9004,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[6552,1429,309,5465,121,120,3262],"class_list":["post-9002","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-astaroth","tag-compromise","tag-deployment","tag-leads","tag-news","tag-sophos","tag-whatsapp"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/9002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9002"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/9002\/revisions"}],"predecessor-version":[{"id":9003,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/9002\/revisions\/9003"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/9004"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}