Astaroth, also known as Guildma, is a banking trojan family built to steal credentials and banking information. Banking trojans focus on financial accounts, but they often also capture browser data, session tokens, or keystrokes so attackers can reuse access later. Astaroth is associated with regional targeting, especially in Portuguese-speaking environments and nearby areas, where language, local services, and familiar delivery methods make lures more convincing.
In real attacks, Astaroth is commonly delivered through social engineering, malicious attachments, or staged download chains that disguise the initial payload. Once a victim opens the lure, the malware can help attackers intercept logins, redirect users, or gather information for account takeover and fraud. Defenders look for suspicious archive files, unexpected scripts, unusual child processes from chat or email attachments, and anti-malware detections tuned for banking trojans. Limiting script execution, verifying linked accounts and sessions, and treating compressed files from trusted contacts as risky all reduce exposure.