Loading story…
The Dark Tequila malware campaign targeted users in Mexico, particularly customers of Mexican banking institutions, in a long-running financial theft operation active since at least 2013. Attackers used spear-phishing and infected USB devices to compromise systems, then deployed a multi-stage payload designed to evade analysis with anti-debugging and anti-virtual-machine checks.
Once installed, the malware harvested banking credentials, website logins, saved passwords, and other sensitive data, then exfiltrated the information to command-and-control servers in encrypted form. The toolset included modules for keylogging, information theft, USB propagation, watchdog services, cleanup, and C2 communications, and it could remotely uninstall itself from systems outside Mexico or otherwise deemed irrelevant to the operators.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
The Dark Tequila financial malware campaign has been active since at least 2013, primarily targeting users in Mexico, especially customers of Mexican banking institutions. It used spear-phishing and infected USB devices as known infection vectors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A fraud operation tracked as **REF6045** is targeting users across Mexico’s financial ecosystem with fake CAPTCHA **ClickFix** lures that trick victims into pasting a malicious command into the Windows Run dialog. The multi-stage infection chain installs a PowerShell-based toolkit called **SCMBANKER**, establishes persistence, and can optionally deploy **Remote Utilities Host** for full remote access. Researchers said the campaign has targeted banks, fintechs, payment processors, cryptocurrency exchanges, investment platforms, tax services, and telecom providers, and has likely been active since at least October 2025. Once installed, SCMBANKER monitors banking sessions, captures screenshots and keystrokes, redirects browsers to phishing pages, displays fake bank warning overlays to push victims into vishing calls, and hijacks clipboard data including **CLABE** and payment card numbers. Elastic Security Labs said an operational security failure exposed parts of the attackers’ infrastructure, including open directories, a leaked web-root archive, and an unauthenticated file editor tied to `68.211.161[.]46`, allowing investigators to recover extensive tooling. The recovered code also showed strong signs of **AI-assisted development**, likely drafted in Spanish and later manually obfuscated.
Jul 10, 2026
Researchers reported that the **BBTok** banking Trojan has been actively targeting users in **Brazil and Mexico**, impersonating more than 40 banks to steal **2FA tokens**, payment card data, and other banking credentials. The malware campaign uses strong geo-fencing and customized delivery chains that adapt lures to a victim’s country and Windows version, helping operators reduce detection while focusing on regional banking customers. Earlier reporting also documented BBTok activity in Mexico, indicating the malware family has remained active across multiple years. Check Point said the operators rely on layered obfuscation and **living-off-the-land binaries** to deploy payloads, including infection chains that use **LNK files**, a renamed `cmd.exe`, **MSBuild**, SMB-hosted XML, and downloader DLLs such as **Trammy** and **Gammy**. Analysis of older server-side artifacts showed the operation has evolved since at least 2022, with experimentation involving **Follina** and **XLL-based** vectors, while server comments and artifacts suggest with high confidence that the threat actors are Brazilian. The campaign was assessed to have targeted hundreds of users and also supports broader remote-control functions beyond credential theft.
Aug 14, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026