I. Executive Intelligence Summary

In the opening decade of 2026, the CyberDudeBivash Neural Forensic Lab has unmasked a high-velocity, multi-language malware campaign codenamed Boto Cor-de-Rosa. This operation represents a terminal evolution of the notorious Astaroth (Guildma) banking trojan. While legacy Astaroth variants relied on email-based siphons, the 2026 variant utilizes a sophisticated Python-based worm to automate the hijacking of WhatsApp Web sessions.

CyberDudeBivash institutional telemetry indicates that the malware leverages the WPPConnect library and Selenium WebDriver to sequestrate active messaging tokens. By siphoning the victim's entire contact list, the worm unmasks every personal relationship to deliver booby-trapped ZIP archives. The "Boto Cor-de-Rosa" (Pink Dolphin) namesake reflects its surreptitious ability to navigate the digital waters of encrypted messaging, liquidating the "Trust Blockade" that typically protects peer-to-peer communication. This  mandate provides the technical depth required to unmask the zapbiu.py propagation module and sequestrate enterprise messaging enclaves from total data liquidation.

II. Threat Lineage: The Path to "Social Siphoning"

The lineage of Astaroth has transitioned from a Delphi-based banking primitive (2015) to a Polyglot Neural Spreader (2026). Historically, Astaroth unmasked itself through malicious LNK files siphoned via bulk phishing emails. By 2024, the syndicate began testing PowerShell-driven session harvesting to bypass browser sandboxing.

In 2026, Boto Cor-de-Rosa confirms a shift toward Application-Specific Liquidation. By incorporating a dedicated Python 3.12 runtime into the installer, the adversary liquidates the need for pre-installed dependencies. The worm focuses exclusively on WhatsApp Web, siphoning the high-value metadata found in corporate and personal chat histories. This lineage confirms that as traditional email security perimeters hardened, threat actors moved to Messenger-Based Propagation to exploit the inherent trust of the contact list. The evolution from "Breaking In" to "Being Invited In" is the primary challenge for the 2026 identity plane.

III. Full Technical Kill Chain Analysis

The Boto Cor-de-Rosa siphon follows a machine-speed kill chain designed to liquidate social graphs through the zapbiu.py orchestrator.

4.1 Initial Access: The Relationship Siphon

Adversaries unmask victims via a WhatsApp message originating from a compromised known contact. The message utilizes local time-of-day greetings ("Bom dia," "Boa noite") and siphons a ZIP archive with a randomized alphanumeric name (e.g., 552_516107-a9af16a8.zip). The lure often claims the file is a document that "can only be viewed on a computer," coercing the user to unmask their WhatsApp Web session on a Windows host.

4.2 Execution: VBS to Python Liquidation

Inside the ZIP is an obfuscated Visual Basic Script (VBS). Upon execution, the VBS liquidates the local defense blockade by siphoning an MSI package (installer.msi). This package deploys a full Python environment into C:\Public\MicrosoftEdgeCache_* and drops the zapbiu.py propagation module. Simultaneously, it reflectively loads the core Delphi Astaroth module to begin banking credential sequestration.

4.3 Persistence: Session-Token Sequestration

The Python module utilizes Selenium WebDriver to interface with the active Chrome/Edge browser processes. It unmasks the WhatsApp Web SQLite database to siphon the wa_auth_token. By sequestrating this token, the worm gains sovereign control over the user's messaging account without needing to bypass 2FA, effectively "Impersonating the Heartbeat" of the user's digital identity.

4.4 Lateral Movement: The Contact-Graph Worm

The zapbiu.py module siphons the entire contact list, excluding groups and broadcast lists to avoid early detection. It then programmatically sends the malicious ZIP to every contact at a rate of 12-15 messages per minute. Our institutional analysis reveals a built-in progress tracker that reports propagation metrics (success/fail rates) back to the manoelimoveiscaioba[.]com C2 enclave.

IV. Forensic Artifacts & Detection Strategy

SOC teams must shift from network auditing to Browser-Plane Impedance Forensics. CyberDudeBivash mandates the following telemetry anchors to unmask the Boto Cor-de-Rosa siphon:

5.1 Host-Based Process Telemetry

• Python execution from Cache: Monitor for python.exe spawning from C:\Public\ or AppData\Local\Temp. This is a classic indicator of siphoned runtime environments.
• WebDriver Orchestration: Detect the presence of chromedriver.exe or msedgedriver.exe requesting access to the browser's User Data directory (Default\Local Storage\leveldb).
• Integrity Checker Bypass: Unmask any VBS/AutoIt processes spawning mshta.exe to liquidate AMSI blockades.

5.2 Network Siphon Artifacts

• C2 Communication: Alert on DNS queries for zapgrande[.]com or manoelimoveiscaioba[.]com. These enclaves host the secondary Python payloads.
• Exfiltration Spikes: Monitor for sudden bursts of outbound HTTPS traffic to non-standard ports (8081, 1337) originating from the browser process, indicating contact-list exfiltration.

V. Mitigation & Hardening Playbook

To liquidate the risk of 2026 WhatsApp siphons, CyberDudeBivash Pvt. Ltd. mandates the following sovereign blockade:

VI. Forensic Integration: The CyberDudeBivash Arsenal

Our Top 10 open-source tools provide the primary sovereign primitives required to unmask and liquidate session siphons before they sequestrate your social graph.

VII. CyberDudeBivash Academy: Social Graph Defense Mastery

To liquidate technical debt and unmask the "Relationship Worms" in your infrastructure, we offer specialized labs in Browser Forensics.

 Institutional & Sovereign Solutions

Our mandate has unmasked the terminal risk of Boto Cor-de-Rosa. For institutional messaging audits, browser infrastructure design, and sovereign forensic consulting, contact our advisory board.

CyberDudeBivash ThreatWire Network

Join the global research blockade. Follow the intelligence stream on our blogs.

X. Strategic Outlook: 2026—The Year of the Messenger Siege

The Boto Cor-de-Rosa siphons unmask a terminal reality: Our social graph is the final frontier for the adversary. As state-aligned and financial syndicates automate the liquidation of instant messaging sessions, defenders must move to Hardware-Anchored Zero Trust and Immutable Browser Infrastructure immediately. The digital border is no longer at the email gateway; it is in the validity of the browser's SQLite database. The mission is absolute.