Loading story…
Researchers detailed Ousaban, a Brazil-focused banking trojan active since at least 2018 that targets financial institutions and regional email services with credential-theft overlays and phishing-led infection chains. The malware, written in Delphi, has been delivered through MSI installers, JavaScript downloaders, and CAB or ZIP archives, then executed via DLL side-loading through legitimate applications. Reporting on Brazilian financial malware also highlighted DLL hijacking and side-loading as a recurring technique in the broader ecosystem of banking threats operating in the region.
Beyond credential theft, Ousaban includes backdoor functions such as keylogging and simulated mouse and keyboard actions, enabling operators to interact directly with infected systems. Recent campaigns used multistage components including encrypted injectors, downloaders, configuration files, and a support module that changed RDP and firewall settings and created a new administrative account for follow-on access. The malware stored remote configuration data on public services including YouTube and later Google Docs, while command-and-control traffic was protected with AES encryption over RealThinClient; researchers also noted code and operational overlaps with other Latin American banking trojans including Grandoreiro, Amavaldo, Mispadu, Vadokrist, Mekotio, Casbaneiro, and Guildma.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
ESET published an analysis describing Ousaban's phishing-based distribution, DLL side-loading, credential-theft overlays, backdoor features, and multistage infection chains. The report also noted recent use of Google Docs for remote configuration and RealThinClient for C2 communications.
ESET stated it has tracked the Ousaban Latin American banking trojan since 2018. The malware has operated exclusively in Brazil in ESET's observations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet reported an ongoing **Ousaban** banking Trojan campaign targeting Microsoft Windows users in Spain and Portugal, using phishing PDFs disguised as corrupted documents to redirect victims to malicious webpages. The operation applies geofencing and environment checks to limit infections to Iberian targets, then delivers a VBS script that extracts a hidden ZIP archive from an image and executes the final payload. Researchers said the campaign marks an evolution from late-2025 Ousaban activity that relied on MSI installers and ClickFix-style lures. Once installed, Ousaban establishes persistence through a Windows Registry `Run` key named `Financeiro` and waits for victims to access banking services. The malware supports **remote control, keylogging, screenshot capture, clipboard manipulation, and fake on-screen messages** to facilitate account takeover. Fortinet said the operators no longer depend on a decoy Pastebin configuration for command-and-control, instead resolving infrastructure through daily changing DDNS hostnames generated from the current date, a tactic that adds resilience and complicates detection.
Aug 11, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026