Loading malware…
Mispadu is a Latin American banking trojan focused primarily on Windows systems and historically associated with campaigns targeting Spanish- and Portuguese-speaking users, especially in Mexico and nearby regions. It is part of the broader LATAM banking malware ecosystem that includes families such as Grandoreiro, Guildma, Casbaneiro, Mekotio, and Amavaldo, which share overlapping tradecraft, similar obfuscation approaches, and closely related distribution patterns. Mispadu has been described as one of the more prominent banking malware families active in Mexico and has also been observed targeting financial and cryptocurrency institutions.
Mispadu commonly relies on user execution as part of multistage infection chains. Observed campaigns have used spam with invoice-themed lures to deliver archive files containing Windows Installer packages and heavily obfuscated scripts, which then launch intermediate loaders before injecting or loading the final Delphi payload into memory. Across the LATAM banking trojan ecosystem, MSI-based first stages, ZIP archives, scripting languages such as VBScript, and DLL side-loading are recurring execution patterns, and Mispadu has been linked to these broader operational practices.
Once active, Mispadu performs environmental checks to restrict execution to intended victims and reduce analysis exposure. It checks system language settings and terminates if the host is not configured for Spanish or Portuguese locales. It has also been reported to enumerate installed security products in the victim environment, reflecting both discovery and defense-evasion objectives. Campaign samples have additionally used anti-virtualization checks before continuing execution.
Its core functionality centers on banking fraud and credential theft. Mispadu steals credentials from browsers including Google Chrome, can harvest credentials from mail clients through bundled NirSoft utilities, monitors browser activity related to online banking, and displays fraudulent banking overlays to capture victim-entered data. It also exfiltrates collected financial information to attacker-controlled infrastructure. Beyond banking credential theft, Mispadu includes clipboard hijacking functionality that can capture and replace copied cryptocurrency wallet data, indicating overlap between banking fraud and crypto-theft monetization.
Mispadu communications have been observed using encrypted command-and-control traffic, including use of OpenSSL in some variants. The malware family is part of a cluster of closely cooperating Latin American banking trojan operators that emphasize social engineering, manual fraud workflows, and regional targeting over fully automated post-compromise operations. More recent reporting indicates that infrastructure and delivery tactics previously associated with Mispadu were later reused by the same actor to distribute other payloads, underscoring the adaptability of the operators behind these campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.
TA2725 is a threat actor Proofpoint tracked since March 2022 that is known for using Brazilian banking malware (including Mispadu, Astaroth, and historically Grandoreiro) and credential phishing to target organizations mainly in Brazil, Mexico, and Spain.
40 distinct techniques documented for this family, organized by ATT&CK tactic.
This campaign uses phishing emails with financial themes, directing users to a compromised website where the payload is hosted...
For this particular case, Mispadu’s entry vector is spam, similar to past campaigns involving the malware. By sending messages that refer to overdue invoices, attackers create a seemingly urgent situation that then persuades receivers to download a .zip file from malicious URLs.
T1047 Windows Management Instrumentation ✅ ❌ ❌ ✅ ❌ ❌ ✅ ✅ ✅ ❌ ❌ ❌
T1059.001 Command and Scripting Interpreter: PowerShell ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ❌ ✅ ✅ ❌
T1059.003 Command and Scripting Interpreter: Windows Command Shell ❌ ✅ ✅ ❌ ✅ ❌ ✅ ✅ ❌ ✅ ✅ ❌
This zip file contains an MSI (Microsoft Installer file) that has a VBScript... reveal the final VBScript file that executes an AutoIT Loader/Injector.
T1059.007 Command and Scripting Interpreter: JavaScript/JScript ✅ ✅ ❌ ✅ ❌ ❌ ✅ ✅ ❌ ✅ ✅ ✅
The final VBScript also loads the AutoIT file, which loads into the memory the final payload: a Delphi file containing the trojan code and processes.
This zip file contains an MSI (Microsoft Installer file) that has a VBScript. This is followed by three layers of obfuscation that, when deobfuscated, reveal the final VBScript file that executes an AutoIT Loader/Injector.
T1036.005 Masquerading: Match Legitimate Name or Location ❌ ✅ ✅ ✅ ❌ ❌ ❌ ✅ ❌ ❌ ❌ ✅
reveal the final VBScript file that executes an AutoIT Loader/Injector... loads into the memory the final payload: a Delphi file containing the trojan code and processes.
they all obfuscate either payloads or configuration data in some way
Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine
to steal credentials, they tend to use either fake pop-up windows or keyloggers
to steal credentials, they tend to use either fake pop-up windows or keyloggers
The Delphi binary executes a browser banking overlay that steals the victim’s data and uses the name and logo of legitimate banks.
T1552.001 Unsecured Credentials: Credentials In Files ❌ ✅ ✅ ✅ ❌ ❌ ❌ ✅ ❌ ❌ ❌ ❌
The binary also has two legitimate tools, NirSoft’s WebBrowserPassView and Mail PassView, which can collect user’s data.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
periodically scanning active windows based on name or title
The final VBScript also retrieves data on the operating system version.
T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌
If the script detects a virtual environment such as the following, the script terminates its execution: Hyper-V VirtualBox VMWare
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
It also inspects whether the system is using any of the following languages... As aforementioned, the attackers are targeting users whose machines are set to use these identified languages. If the system is using a different language ID from those listed, the attack process stops.
Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine
to steal credentials, they tend to use either fake pop-up windows or keyloggers
to steal credentials, they tend to use either fake pop-up windows or keyloggers
The Mispadu payload contained a hardcoded C2 address which used HTTPS as communication protocol.
We believe these to be the command and control servers used by the malware... POST PUT Content-Disposition: form-data... Mozilla/5.0 ... HTTP/1.1 200 OK
155 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking trojan identified as active in Mexico.
Referenced only as related reading about Latin American banking malware; no campaign details are provided in this content.
Banking trojan/stealer targeting financial and cryptocurrency institutions in Mexico.
Banking trojan targeting Latin America (notably Mexico and Brazil) delivered via phishing with HTA attachments (sometimes via password-protected PDFs); uses an AutoIT loader and dynamically generated delivery artifacts to frustrate EDR; includes self-propagation via email and expanded targeting to banks outside LATAM and crypto exchanges.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.