Loading story…
Fortinet reported an ongoing Ousaban banking Trojan campaign targeting Microsoft Windows users in Spain and Portugal, using phishing PDFs disguised as corrupted documents to redirect victims to malicious webpages. The operation applies geofencing and environment checks to limit infections to Iberian targets, then delivers a VBS script that extracts a hidden ZIP archive from an image and executes the final payload. Researchers said the campaign marks an evolution from late-2025 Ousaban activity that relied on MSI installers and ClickFix-style lures.
Once installed, Ousaban establishes persistence through a Windows Registry Run key named Financeiro and waits for victims to access banking services. The malware supports remote control, keylogging, screenshot capture, clipboard manipulation, and fake on-screen messages to facilitate account takeover. Fortinet said the operators no longer depend on a decoy Pastebin configuration for command-and-control, instead resolving infrastructure through daily changing DDNS hostnames generated from the current date, a tactic that adds resilience and complicates detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-02, Gurucul published analysis of the ongoing Ousaban campaign that included domains, IP addresses, SHA-256 hashes, and example detection queries. The report also described the malware's execution via DLL side-loading or process injection.
On 2026-07-01, FortiGuard Labs published an analysis describing the ongoing Ousaban attacks targeting the Iberian Peninsula, including the malware's persistence, banking-focused monitoring, and date-derived daily changing command-and-control hostnames.
The May 2026 campaign redirected victims from phishing PDFs to malicious webpages that downloaded a VBS script, which extracted a ZIP archive hidden inside an image and executed the final Ousaban payload. Fortinet said this reflected an evolution in the malware's delivery chain.
In May 2026, operators behind the Brazilian banking trojan Ousaban targeted Microsoft Windows users in Spain and Portugal with phishing PDFs posing as corrupted files. The campaign used geofencing and environment checks to limit payload delivery to intended Iberian victims.
Fortinet reported that Ousaban activity observed in late 2025 used earlier delivery methods, including MSI installers and ClickFix-style lures, before the campaign evolved to newer phishing techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcefeeds.fortinet.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026
A Brazilian cybercrime group tracked as **Augmented Marauder** and **Water Saci** is targeting Spanish-speaking users at organizations across Latin America and Europe with a multi-stage phishing campaign that delivers the **Casbaneiro** banking trojan and uses **Horabot** for delivery and propagation. The operation begins with court summons-themed phishing emails carrying password-protected PDF lures that direct victims to malicious links and ZIP archives, leading to execution of `HTA` and `VBS` payloads, followed by AutoIt loaders and encrypted malware components. Researchers said the malware chain includes anti-analysis checks, retrieval of additional payloads from remote servers, and dynamically generated judicial-themed PDF attachments created through a remote PHP API using random PINs. Horabot helps expand the campaign by harvesting Outlook contacts, abusing compromised email accounts, and sending new phishing messages, while the broader operation also incorporates **ClickFix** social engineering and **WhatsApp-based** distribution to evade defenses and widen infections.
Jun 29, 2026
Kaspersky reported that the **Grandoreiro** banking trojan has continued operating globally despite law-enforcement disruptions and arrests, expanding from targeting about **900 banks in 40 countries** in 2023 to roughly **1,700 banks and 276 crypto wallets across 45 countries and territories** in 2024. Telemetry recorded more than **150,000 blocked infection attempts** affecting over **30,000 users** worldwide between January and October 2024, underscoring the malware’s sustained scale and resilience. Recent Grandoreiro campaigns used phishing emails, malvertising, **MSI-based loaders**, **DLL sideloading**, oversized padded binaries, and **CAPTCHA-based sandbox evasion** to infect victims. Kaspersky said newer versions also introduced fragmented codebases, stronger encryption, three domain generation algorithms for command-and-control, and mouse-behavior tracking to evade fraud detection, while preserving core capabilities including remote machine control, credential theft, one-time-password harvesting through overlays, clipboard replacement for cryptocurrency theft, and fraudulent banking transactions; some legacy variants are now concentrating on targets in Mexico.
Jun 29, 2026