Loading story…
Researchers detailed Zumanek, a Brazilian banking malware family that uses a multi-stage infection chain to steal credentials from victims of online banking and cryptocurrency services. The malware was observed almost exclusively in Brazil and begins with a socially engineered downloader that verifies the system is configured for Brazilian Portuguese, checks for installed security products, retrieves a ZIP payload from its command-and-control infrastructure, and launches the final banker and remote-access trojan stage.
The final payload abuses DLL hijacking by pairing a legitimate signed executable with a malicious DLL, then establishes persistence, injects into notepad.exe, and redirects targeted banking activity into Internet Explorer for credential theft through form grabbing. Zumanek communicates with its C2 over HTTP POST requests and multiple sockets, and supports a broad set of remote-control functions including screenshots, browser manipulation, and actions associated with keylogging, underscoring continued evolution in Brazilian financial malware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The analyzed Zumanek downloader sample carried a PE header compilation timestamp of 28 December 2017. ESET identified this sample as part of Zumanek version 3.0.
ESET said the Zumanek banking malware family was first detected approximately three months before the article was written, placing its initial detection around late 2017. The malware was observed almost exclusively in Brazil.
ESET publicly documented Zumanek as a new Brazilian banker malware family, detailing its multi-stage infection chain, DLL hijacking technique, persistence, browser redirection, and credential theft targeting banks and cryptocurrency services. The report also noted that Zumanek was not yet among the top 10 most detected spyware or banker families in Brazil.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Brazilian banking malware has evolved from basic keyloggers and phishing Trojans into more sophisticated toolsets that use obfuscation, encryption, process injection, browser automation, remote administration, and even ransomware techniques. Researchers said operators adapted quickly to banking defenses such as virtual keyboards, machine fingerprinting, and two-factor authentication by shifting to mouseloggers, hosts-file redirection, Internet Explorer automation, RunPE-style loaders, AutoIt and .NET crypters, and live operator-controlled remote access Trojans, with code quality and operational tradecraft improving markedly over time. One delivery method highlighted in later activity used malformed ZIP archives prefixed with a UTF-8 Byte Order Mark to evade some email scanners and make the files appear corrupted to certain tools while remaining extractable with common utilities. The recovered loader decrypted an embedded DLL from its resources with an XOR-based routine, executed the exported function `BICDAT`, then fetched a second-stage password-protected ZIP that delivered a Banking RAT seen broadly in Brazil and Chile, underscoring how Brazilian cybercriminals combined local banking fraud expertise with increasingly advanced malware packaging and execution chains.
Aug 15, 2026
The **Bizarro** banking Trojan, long associated with Brazilian cybercrime, expanded its operations to victims in **Spain, Portugal, France, Italy, Germany, Argentina, Chile, and Brazil**, broadening a campaign focused on stealing online banking credentials and enabling fraud. Researchers said the malware was delivered through spam emails that pushed victims to download **MSI installers**, which then retrieved additional payloads from compromised websites, hacked WordPress servers, and cloud-hosted infrastructure on **Azure** and **AWS**. Once installed, Bizarro used heavy obfuscation and a backdoor supporting more than **100 commands** to disrupt browser sessions, capture screens, log keystrokes, and hijack clipboard data. The operators also relied heavily on social engineering, displaying fake banking pop-ups, bogus security-update prompts, and requests for **two-factor authentication** codes, while also using malicious **QR codes** that could redirect victims to Android malware to extend the fraud chain beyond desktop systems.
Aug 14, 2026
Researchers detailed ongoing activity by **Numando**, a Latin American banking trojan written in Delphi that has been active since at least 2018 and primarily targets victims in Brazil, with less frequent campaigns in Mexico and Spain. The malware is commonly delivered through spam emails carrying ZIP attachments with MSI installers, then launched via **DLL side-loading** using a legitimate application, an injector, and an encrypted payload. Once installed, Numando displays fake banking overlays to capture sensitive information and supports a broad set of backdoor functions, including simulating mouse and keyboard actions, taking screenshots, killing browser processes, and restarting or shutting down the infected machine. The malware also uses several distinctive tradecraft elements, including numeric command identifiers, decoy ZIP archives with encrypted URLs hidden in ZIP comments, BMP images used to conceal payloads in overlays, and remote configuration data stored on public services such as **YouTube** and **Pastebin**, encrypted with keys hardcoded in the binary.
Aug 14, 2026