Do Son Sophos exposed STAC3150, a campaign using fake "View Once" messages to deploy Astaroth banking trojan. The malware hijacks WhatsApp Web sessions via WPPConnect/Selenium for self-propagation.
Selenium
Trend exposed the Water Saci worm, a self-propagating campaign that hijacks WhatsApp Web using Selenium/PowerShell. It uses a stealthy IMAP email C2 channel with HTTP fallback.
CVE-2025-4641: XXE flaw in popular WebDriverManager library (CVSS 9.3) exposes test systems to file leaks and SSRF. Patch to 6.0.2 now.