Casbaneiro and Horabot Phishing Campaign Hits Latin America and Europe

A Brazilian cybercrime group tracked as Augmented Marauder and Water Saci is targeting Spanish-speaking users at organizations across Latin America and Europe with a multi-stage phishing campaign that delivers the Casbaneiro banking trojan and uses Horabot for delivery and propagation. The operation begins with court summons-themed phishing emails carrying password-protected PDF lures that direct victims to malicious links and ZIP archives, leading to execution of HTA and VBS payloads, followed by AutoIt loaders and encrypted malware components.

Researchers said the malware chain includes anti-analysis checks, retrieval of additional payloads from remote servers, and dynamically generated judicial-themed PDF attachments created through a remote PHP API using random PINs. Horabot helps expand the campaign by harvesting Outlook contacts, abusing compromised email accounts, and sending new phishing messages, while the broader operation also incorporates ClickFix social engineering and WhatsApp-based distribution to evade defenses and widen infections.