Loading story…
Researchers reported that the BBTok banking Trojan has been actively targeting users in Brazil and Mexico, impersonating more than 40 banks to steal 2FA tokens, payment card data, and other banking credentials. The malware campaign uses strong geo-fencing and customized delivery chains that adapt lures to a victim’s country and Windows version, helping operators reduce detection while focusing on regional banking customers. Earlier reporting also documented BBTok activity in Mexico, indicating the malware family has remained active across multiple years.
Check Point said the operators rely on layered obfuscation and living-off-the-land binaries to deploy payloads, including infection chains that use LNK files, a renamed cmd.exe, MSBuild, SMB-hosted XML, and downloader DLLs such as Trammy and Gammy. Analysis of older server-side artifacts showed the operation has evolved since at least 2022, with experimentation involving Follina and XLL-based vectors, while server comments and artifacts suggest with high confidence that the threat actors are Brazilian. The campaign was assessed to have targeted hundreds of users and also supports broader remote-control functions beyond credential theft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point said analysis of multiple ps_gen.ps1 versions dating back to July 2022 showed the operators continuously changed their server-side payload generation and delivery chains. Older artifacts also showed experimentation with Follina and XLL-based infection vectors.
A 360 Total Security blog post reported BBTok activity in Mexico, establishing that the banking Trojan was active by November 2020. Check Point later stated the malware had been active since at least 2020.
Check Point Research disclosed an active BBTok campaign targeting users in Brazil and Mexico with customized ZIP and ISO lures, geo-fencing, and country-specific downloader DLLs. The report described a new BBTok variant impersonating more than 40 banks to steal 2FA codes and payment card data.
2 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourceblog.360totalsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
The **Bizarro** banking Trojan, long associated with Brazilian cybercrime, expanded its operations to victims in **Spain, Portugal, France, Italy, Germany, Argentina, Chile, and Brazil**, broadening a campaign focused on stealing online banking credentials and enabling fraud. Researchers said the malware was delivered through spam emails that pushed victims to download **MSI installers**, which then retrieved additional payloads from compromised websites, hacked WordPress servers, and cloud-hosted infrastructure on **Azure** and **AWS**. Once installed, Bizarro used heavy obfuscation and a backdoor supporting more than **100 commands** to disrupt browser sessions, capture screens, log keystrokes, and hijack clipboard data. The operators also relied heavily on social engineering, displaying fake banking pop-ups, bogus security-update prompts, and requests for **two-factor authentication** codes, while also using malicious **QR codes** that could redirect victims to Android malware to extend the fraud chain beyond desktop systems.
Aug 14, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026