Astaroth banking malware spreads through victims' WhatsApp contacts in Brazil (Boto Cor-de-Rosa)
A WhatsApp worm, 'Boto Cor-de-Rosa', spreads the Astaroth banking trojan on Windows. It sends a ZIP file to every contact of an infected user. It mainly hits Brazil. Don't open unexpected ZIPs, even from people you know.
Don't open ZIP files or run scripts sent over WhatsApp, even from someone you know, unless you've checked with them by another means. If you opened one on a Windows computer, disconnect it, run a full security scan, change your banking passwords from a different device and tell your bank.
What’s happening
In January 2026 the security firm Acronis described a campaign it calls Boto Cor-de-Rosa, which spreads the Astaroth banking trojan through WhatsApp. A victim gets a WhatsApp message with a ZIP file, sent with a casual Portuguese greeting and an offer of a requested file. Opening the ZIP runs a hidden script on a Windows computer. The script installs the banking malware and a Python tool that spreads it. The tool copies the victim's WhatsApp contact list, sends it to a remote server and messages each contact the same ZIP, so the malware passes from one person to the next. The banking part watches web browsing and acts when the person visits a banking site, to steal credentials. Acronis said the campaign mainly targeted people in Brazil. Neither Acronis nor Hackread reported how many people were infected. No WhatsApp response was reported. As of 3 November 2026 we found no later official update. This is malware delivered by trickery, not a software flaw, so there is no patch.
- What
- Scam
- Affects
- WhatsApp Web on Windows computers (Astaroth banking trojan)
- Affected
- Windows computers where WhatsApp is used, mainly in Brazil
- Fixed in
- Nothing to patch
- Since
- 8 Jan 2026
- Closed
- 8 Jan 2026
Timeline
- UpdateNothing to patch
Hackread reported the same findings, adding that the spreader picks a Portuguese greeting by the computer's clock and logs progress every 50 messages. It noted that earlier Astaroth campaigns mostly used email. It reported no WhatsApp statement and no count of victims or messages sent.
- Made publicNothing to patch
Acronis's Threat Research Unit published its report on the 'Boto Cor-de-Rosa' campaign. Victims get a WhatsApp message with a ZIP file that installs the Astaroth banking trojan on Windows and a Python tool that sends the same ZIP to the victim's contacts. Acronis said it targeted mainly Brazilian users and gave no victim total.
Sources
- Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in BrazilAcronis Threat Research Unit · 8 Jan 2026
- Astaroth banking trojan spreads in Brazil through WhatsApp messagesHackread · 8 Jan 2026