Astaroth Banking Malware Resurfaces in Brazil via Spear-Phishing Attack

A new spear-phishing campaign targeting Brazil has been found delivering a banking malware called Astaroth (aka Guildma) by making use of obfuscated JavaScript to slip past security guardrails.

“The spear-phishing campaign’s impact has targeted various industries, with manufacturing companies, retail firms, and government agencies being the most affected,” Trend Micro said in a new analysis.

“The malicious emails often impersonate official tax documents, using the urgency of personal income tax filings to trick users into downloading the malware.”

The cybersecurity company is tracking the threat activity cluster under the name Water Makara. It’s worth pointing out that Google’s Threat Analysis Group (TAG) has assigned the moniker PINEAPPLE to a similar intrusion set that delivers the same malware to Brazilian users.

Both these campaigns share a point of commonality in that they commence with phishing messages that impersonate official entities such as Receita Federal and aim to trick recipients into downloading a ZIP archive attachment that masquerades as income tax documents.

Present within the harmful ZIP file is a Windows shortcut (LNK) that abuses mshta.exe, a legitimate utility meant to run HTML Application files, execute obfuscated JavaScript commands and establish connections to a command-and-control (C2) server.

“While Astaroth might seem like an old banking trojan, its reemergence and continued evolution make it a persistent threat,” the researchers said.

“Beyond stolen data, its impact extends to long-term damage to consumer trust, regulatory fines, and increased costs from business disruption and downtime as well as recovery and remediation.”

To mitigate the risk posed by such attacks, it’s recommended to enforce strong password policies, use multi-factor authentication (MFA), keep security solutions and software updated, and apply the principle of least privilege (PoLP).