Astaroth Banking Trojan Targets Brazilians via WhatsApp Messages

Researchers at Acronis have discovered a new campaign called Boto Cor-de-Rosa, where the Astaroth banking malware spreads like a worm through WhatsApp Web to steal contact lists and banking credentials.

A well-known, dangerous banking malware called Astaroth has found a new way to break into people’s lives by sneaking into WhatsApp. The findings come from the Acronis Threat Research Unit (TRU), with the formal report released on Thursday, January 8, 2026.

Acronis has identified a new campaign dubbed Boto Cor-de-Rosa in which the malware acts like a digital worm, spreading automatically from one person’s contact list to the next, and mainly targeting Brazilians.

Lead researchers Jozsef Gegeny and Jonathan Micael noted in the blog post, shared with Hackread.com, that while its operators have usually exploited email, this new tactic exploits the trust we place in our chat apps.

How the Malware Breaks In

For any user, getting ...