Connect with us

Technology

WhatsApp Web malware spreads banking trojan automatically

Published

on

WhatsApp Web malware spreads banking trojan automatically

NEWYou can now listen to Fox News articles!

A new malware campaign is turning WhatsApp Web into a weapon. Security researchers say a banking Trojan linked to Astaroth is now spreading automatically through chat messages, making the attack harder to stop once it starts. 

The campaign is known as Boto Cor-de-Rosa. It shows how cybercriminals keep evolving, especially when they can abuse tools people trust every day. This attack focuses on Windows users and uses WhatsApp Web as both the delivery system and the engine that spreads the infection further.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Advertisement

BROWSER EXTENSION MALWARE INFECTED 8.8M USERS IN DARKSPECTRE ATTACK

Attackers abuse WhatsApp Web to spread malware through messages that appear to come from people you trust. (Kurt “CyberGuy” Knutsson)

How this WhatsApp Web attack works

The attack starts with a simple message. A contact sends what looks like a routine ZIP file through WhatsApp. The file name appears random and harmless, which lowers suspicion. Once opened, the ZIP contains a Visual Basic script disguised as a normal document. If the user runs it, the script quietly pulls in two more pieces of malware. Then the script downloads the Astaroth banking malware written in Delphi. It also installs a Python-based module designed to control WhatsApp Web. Both components run in the background without obvious warning signs. From there, the infection becomes self-sustaining.

Malware that spreads itself through your contacts

What makes this campaign especially dangerous is how it propagates. The Python module scans the victim’s WhatsApp contacts and sends the malicious ZIP file to every conversation automatically. Researchers at Acronis found that the malware adapts its messages based on the time of day. It sends friendly greetings, making the message feel normal and familiar. The text reads, “Here is the requested file. If you have any questions, I’m available!” Because the message appears to come from someone you know, many people open it without hesitation.

NEW MALWARE CAN READ YOUR CHATS AND STEAL YOUR MONEY

Advertisement

A single ZIP file sent through chat can quietly install banking malware and begin spreading to every contact. (Kurt “CyberGuy” Knutsson)

Built-in tracking keeps the attack efficient

This malware is carefully designed to monitor its own performance in real time. The propagation tool tracks how many messages are successfully delivered, how many fail to send, and the overall sending speed measured per minute. After every 50 messages, it generates progress updates that show how many contacts have been reached. This feedback allows attackers to measure success quickly and make adjustments if something stops working.

What happens after infection

The initial script is heavily obfuscated to avoid detection by antivirus tools. Once it runs, it launches PowerShell commands that download more malware from compromised websites. One known domain used in this campaign is coffe-estilo.com. The malware installs itself inside a folder that mimics a Microsoft Edge cache directory. Inside are executable files and libraries that make up the full Astaroth banking payload. From there, the malware can steal credentials, monitor activity and potentially access financial accounts.

Why WhatsApp Web is being abused

WhatsApp Web is popular because it mirrors your phone conversations on a computer. That convenience makes it easy to send messages, share files and type faster, but it also introduces risk. When you use WhatsApp Web, you link your phone to a browser by scanning a QR code at web.whatsapp.com. Once connected, that browser session becomes a trusted extension of your account. Your chats appear on the screen, messages you send come from your real number and incoming messages sync across both devices.

That setup is exactly what attackers take advantage of. If malware gains access to a computer with WhatsApp Web logged in, it can act as the user. It can read messages, access contact lists and send files or links that look completely legitimate. The messages do not raise alarms because they are coming from a real account, not a fake one.

Advertisement

This is what turns WhatsApp Web into an effective delivery system for malware. Instead of breaking into WhatsApp itself, attackers simply abuse an open browser session to spread malicious files automatically. Many users do not realize the danger because WhatsApp Web feels harmless. It is often left signed in on work computers, shared devices or systems without strong security. In those situations, malware does not need advanced tricks. It only needs access to an already trusted session. That combination of convenience and trust is why WhatsApp Web has become such an attractive target.

MALICIOUS MAC EXTENSIONS STEAL CRYPTO WALLETS AND PASSWORDS

Once WhatsApp Web is compromised, malware can act like the user, sending messages and files that look completely legitimate.  (Kurt “CyberGuy” Knutsson)

How to stay safe from WhatsApp Web malware

Attacks like this WhatsApp Web malware are designed to spread fast through trusted conversations. A few smart habits can dramatically lower your risk.

1) Be skeptical of unexpected attachments

Messaging apps feel casual, which is exactly why attackers use them. Never open ZIP files sent through chat unless you confirm with the sender first. Watch for file names made of random numbers or unfamiliar names. Treat messages that create urgency or feel overly familiar as a warning sign. If a file arrives out of nowhere, pause before clicking.

Advertisement

2) Lock down WhatsApp Web access

This campaign abuses WhatsApp Web to spread automatically once a device is infected. Check active WhatsApp Web sessions and log out of any you do not recognize. Avoid leaving WhatsApp Web signed in on shared or public computers. Enable two-factor authentication (2FA) inside WhatsApp settings. Cutting off Web access helps limit how far malware can travel.

3) Keep your Windows PC locked down and use strong antivirus software 

This type of malware takes advantage of systems that fall behind on updates. Install Windows updates as soon as they are available. Also, keep your web browser fully updated. Staying current closes many of the doors attackers try to slip through. In addition, use strong antivirus software that watches for script abuse and PowerShell activity in real time.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

4) Limit how much of your personal data is online

Banking malware often pairs with identity theft and financial fraud. One way to reduce the fallout is by shrinking your digital footprint. A data removal service can help remove your personal information from data broker sites that attackers often search. With less information available, criminals have fewer details to exploit if malware reaches your device.

Advertisement

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

5) Add identity theft protection for extra coverage

Even with strong security habits, financial monitoring adds another layer of protection. An identity theft protection service can watch for suspicious activity tied to your credit and personal data. Identity theft companies can monitor personal information like your Social Security number (SSN), phone number, and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

You should also turn on alerts for bank and credit card transactions so you are notified quickly if something looks wrong. The less exposed your data is, the fewer opportunities attackers have to cause damage.

Advertisement

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

6) Slow down and trust your instincts

Most malware infections happen because people act too quickly. If a message feels off, trust that instinct. Familiar names and friendly language can lower your guard, but they should never replace caution. Take a moment to verify the message or file before opening anything. Attackers rely on trust and urgency to succeed. Slowing down takes away their advantage.

Kurt’s key takeaways

This WhatsApp Web malware campaign is a reminder that cyberattacks no longer rely on obvious red flags. Instead, they blend into everyday conversations and use familiar tools to spread quietly and quickly. What makes this threat especially concerning is how little effort it takes for it to move from one device to dozens of others. A single click can turn a trusted chat into a delivery system for banking malware and identity theft. The good news is that small changes make a big difference. Paying attention to attachments, locking down WhatsApp Web access, keeping devices updated and slowing down before clicking can stop these attacks cold. As messaging platforms continue to play a bigger role in daily life, staying alert is no longer optional. Awareness and simple habits remain some of the strongest defenses you have.

Do you think messaging apps are doing enough to protect users from malware that spreads through trusted conversations?  Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement

Sign up for my FREE CyberGuy Report 

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2026 CyberGuy.com.  All rights reserved.

Technology

Valve says it’s ready to launch the Steam Machine this summer

Published

on

Valve says it’s ready to launch the Steam Machine this summer

Valve now says that the delayed Steam Machine PC and Steam Frame VR headset are set to launch sometime this summer. In a Thursday blog post detailing its Verified programs for both pieces of hardware, Valve concludes by saying that “We’re excited for players to try your titles on the new Steam hardware once they launch this summer.”

When the company originally announced the Machine and Frame alongside its new Steam Controller late last year, it said that it would start shipping the new gadgets in early 2026. But in February, the company announced that the ongoing memory and storage crunch had forced it to revisit its pricing and shipping plans. And in March, Valve said in a blog post that it would be “shipping all three products this year” — though that was after the company initially said in the post that “we hope to ship in 2026,” which it removed in an update.

Valve opted to release the Steam Controller on its own, putting it up for sale in early May. For the Machine and Frame, while “summer” isn’t exactly a specific date, it narrows the window for when the products might finally come out.

Ahead of actually launching the devices, Valve is redesigning the Steam store and sharing information about the Verified programs for the hardware so that developers can prepare their games. Like with the Steam Deck, if a game is verified for the Machine or the Frame, the badge signals that the game should work well without any tweaks from the user.

For the Machine, the requirements for a game to be verified are “nearly identical” to what they are for the Steam Deck. With the Machine being “roughly six times as powerful” as the Deck, in theory, many more games will be verified for it. Valve also says that it’s testing “every title on Machine that fell below our performance requirements on Deck.”

Advertisement

For the Frame, Valve’s verified badge will signify games that run well while being played natively on the headset — as opposed to games that work well streamed to the headset, which the Frame is also capable of. “Like Steam Deck Verified, the Steam Frame Standalone Verified program focuses on the experience customers will have with the device out-of-the-box in standalone mode,” Valve says.

Now, we just need Valve to share exactly when the Steam Machine and Steam Frame will be released and how much they might cost. After last week’s price hikes for the Steam Deck, I’m gearing up for sticker shock.

Continue Reading

Technology

Are humanoid robots now coming for retail jobs?

Published

on

Are humanoid robots now coming for retail jobs?

NEWYou can now listen to Fox News articles!

Humanoid robots just got another real job. This time, they are clocking in behind the scenes at a major retail operation. Figure AI has signed a commercial agreement with Catalyst Brands. That is the company behind JCPenney, Aéropostale, Brooks Brothers, Eddie Bauer, Lucky Brand and Nautica.

The first rollout begins at Catalyst’s Reno, Nevada Distribution Logistics Center. So, no, these robots are not greeting shoppers or folding jeans in the store aisle. At least not yet.

For now, they are heading into warehouse and supply chain work. Still, the announcement has some people worried. Many see humanoid robots entering a workplace and immediately wonder what happens to human jobs. That concern is fair.

Join CyberGuy Live: Lock Down Your Phone in 30 Minutes (Saturday, June 13, 10 am ET)

  • Your phone holds your email, passwords, photos, banking apps and personal data. In this free, live online class, Kurt the CyberGuy will walk you step by step through simple phone security fixes you can do in real time. You’ll learn how to improve your privacy settings, spot the latest phone scams, use trusted security tools and walk away with a simple checklist to stay protected. Register here: CyberGuyLive.com.

THE AI-POWERED ROBOT ARMY THAT PACKS YOUR GROCERIES IN MINUTES

Figure’s humanoid robots are starting behind the scenes in Catalyst Brands’ Reno warehouse, not on the store floor. (Figure AI)

Advertisement

Figure’s humanoid robots enter warehouse work

Catalyst Brands says Figure’s humanoid robots will help with supply chain work. The companies say the robots will focus on repetitive, physically demanding sorting and packing tasks. In other words, this starts with warehouse work that can wear people down over time. The robots will first assist with Catalyst’s Joey Pouch sorting system in Reno. That system helps with computerized induction, sorting and packing inside the facility. Catalyst says the Reno site also underwent a $40 million infrastructure update in 2024.

“As we invest in and scale our portfolio, this collaboration with Figure shows how emerging technologies can modernize our operations while strengthening our workforce,” said Marc Rosen, CEO of Catalyst Brands. “When we automate routine tasks, our associates can focus on higher-value work and better serve our customers across all our brands.”

So, this is happening behind the scenes in the warehouse, not on the store floor. That detail is important, especially because some online reactions made it sound like robots were already headed into retail stores. The announcement points to warehouse operations first. Still, warehouse jobs are real jobs. That is why this deal is getting so much attention.

Why the Figure AI and Catalyst Brands deal stands out

Catalyst Brands owns several major retail brands and operates a large retail network. Figure AI also describes this as a step toward deploying humanoid robots at scale, even though it has not said how many robots will be used.

There is also a financial connection behind the scenes. Brookfield is an investor in Figure AI and also has a stake in Catalyst Brands. Figure says this is the first commercial bridge between Figure and a Brookfield portfolio company.

Advertisement

If the robots perform well in Reno, the companies could look for more ways to use them across the business.

AI LAYOFFS MAY BE BACKFIRING ON COMPANIES

The robots will first assist with repetitive sorting and packing work inside Catalyst’s updated distribution center. (Figure AI)

What Figure AI has not revealed yet

The announcement leaves out several key details. We do not know how many robots Figure AI will deploy. We do not know the exact start date. We also do not know whether Catalyst is buying the robots, leasing them or using a robots-as-a-service model. The companies have also not said how many human roles could change because of the rollout.

Figure AI says the robots are being integrated into Catalyst’s distribution facility and will focus on physically demanding work. However, the release does not spell out the exact jobs the robots will handle day to day.

Advertisement

That missing information gives people room to worry. It also gives people room to guess. And online, people did both. Some thought humanoid robots were coming straight into stores. Others focused on the bigger fear, which is that robots could take over jobs that people depend on.

Why humanoid robots make workers nervous

The fear around this deal goes beyond one company. Workers have already watched companies use AI to cut costs, slow hiring and reorganize teams. Now, physical robots are entering spaces where people lift, sort, pack and move products. That feels different.

Figure AI and Catalyst say the robots can handle routine tasks and help associates shift toward higher-value work. That sounds promising. However, workers may hear a very different message. They may wonder who gets retrained. They may also wonder who gets replaced. Companies cannot brush off those concerns. If humanoid robots are coming into more workplaces, workers deserve clear answers.

JOBS THAT ARE MOST AT RISK FROM AI, ACCORDING TO MICROSOFT

The big question is whether humanoid robots will help workers handle tough warehouse tasks or eventually replace some of those jobs. (Figure AI)

Advertisement

Why retail companies want warehouse robots

Warehouse work can be tough on the body. People lift boxes, move products, repeat the same motions and race to keep up when orders spike. That is why retail companies are looking hard at automation.

Figure’s pitch is that humanoid robots can fit into places already built for people. They do not need a warehouse rebuilt from scratch. In theory, they can step into certain jobs and help with repetitive work.

For a retailer, that could mean products move faster, and workers face less physical strain. It could also help during busy shopping seasons, when distribution centers get slammed.

What to watch next with Figure AI robots

The next big signal will be whether Catalyst expands the robot program beyond Reno. A small rollout may be a learning test. A wider deployment would point to a much larger shift in how retailers move products.

Watch for details on robot count, job duties and worker impact. Those specifics will tell us more than anything else. Also, pay attention to how companies talk about employees. If they say robots will help workers move into better roles, they should explain exactly how that will happen. Workers deserve more than buzzwords.

Advertisement

What this means for you

These robots may start in a warehouse, but the ripple effect could eventually reach workers, shoppers and prices.

For shoppers, the upside is easy to see. If robots help move products faster, stores may have fewer empty shelves. Online orders could also move through warehouses more quickly.

For workers, it gets more complicated. Companies often say robots will take over the hardest tasks so people can move into better roles. That sounds good, but workers need more than a promise. They need training. They need clear answers. They also need to know whether a robot is there to help them or replace them.

And for the rest of us, this raises a bigger question. Are we comfortable with retailers using humanoid robots if it makes shopping faster or cheaper? Or do we want companies to prove that people are still part of the plan?

Kurt’s key takeaways

Figure AI’s deal with Catalyst Brands shows how quickly humanoid robots are entering our workplaces. For now, these robots are starting in a distribution center. They are not walking through the aisles at JCPenney. That distinction is important. Still, the bigger concern remains. People want to know whether these machines will help workers or slowly push them aside. Automation can reduce hard physical work. It can also create real fear when companies avoid direct answers. Humanoid robots may soon become a normal part of warehouse operations for retailers. The real test will be whether companies use them in a way that helps people, instead of treating people like a cost to cut.

Advertisement

Would you shop with a retailer that uses humanoid robots in its warehouses, or would that make you think twice? Let us know by writing to us at CyberGuy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.

Continue Reading

Technology

Cyberdecks used to look like little laptops, but now they’re getting more personal

Published

on

Cyberdecks used to look like little laptops, but now they’re getting more personal

Tan and countless other DIYers are attracting millions of views showing off the personal computers they’ve built inside purses, jewelry boxes, toys, and old tech, hiding Raspberry Pi boards inside art projects.

Cyberdecks, but make it fashion

The colorful, quirky builds popping up across social media are a drastic shift away from the typical look the cyberdecks we’ve featured have had, which often consisted of a 3D-printed chassis or a rugged box like a Pelican case, usually with a cyberpunk-style design.

Inside, these homemade devices are essentially mini Linux computers for specific tasks, usually done offline, like reading, journaling, or listening to music. But now, a cyberdeck doesn’t have to look like a computer at all.

Continue Reading
Advertisement

Trending