Loading story…
Researchers detailed ongoing activity by Numando, a Latin American banking trojan written in Delphi that has been active since at least 2018 and primarily targets victims in Brazil, with less frequent campaigns in Mexico and Spain. The malware is commonly delivered through spam emails carrying ZIP attachments with MSI installers, then launched via DLL side-loading using a legitimate application, an injector, and an encrypted payload.
Once installed, Numando displays fake banking overlays to capture sensitive information and supports a broad set of backdoor functions, including simulating mouse and keyboard actions, taking screenshots, killing browser processes, and restarting or shutting down the infected machine. The malware also uses several distinctive tradecraft elements, including numeric command identifiers, decoy ZIP archives with encrypted URLs hidden in ZIP comments, BMP images used to conceal payloads in overlays, and remote configuration data stored on public services such as YouTube and Pastebin, encrypted with keys hardcoded in the binary.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the threat actor behind the Numando banking trojan has been active since at least 2018. The malware primarily targets victims in Brazil, with rarer campaigns observed in Mexico and Spain.
Numando operators abused YouTube to host remote configuration data for the malware. After notification by ESET, Google removed the configuration videos from YouTube.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
Researchers detailed **Zumanek**, a Brazilian banking malware family that uses a multi-stage infection chain to steal credentials from victims of online banking and cryptocurrency services. The malware was observed almost exclusively in Brazil and begins with a socially engineered downloader that verifies the system is configured for Brazilian Portuguese, checks for installed security products, retrieves a ZIP payload from its command-and-control infrastructure, and launches the final banker and remote-access trojan stage. The final payload abuses **DLL hijacking** by pairing a legitimate signed executable with a malicious DLL, then establishes persistence, injects into `notepad.exe`, and redirects targeted banking activity into Internet Explorer for credential theft through form grabbing. Zumanek communicates with its C2 over HTTP POST requests and multiple sockets, and supports a broad set of remote-control functions including screenshots, browser manipulation, and actions associated with keylogging, underscoring continued evolution in Brazilian financial malware.
Aug 14, 2026
Researchers detailed **Ousaban**, a Brazil-focused banking trojan active since at least 2018 that targets financial institutions and regional email services with credential-theft overlays and phishing-led infection chains. The malware, written in Delphi, has been delivered through MSI installers, JavaScript downloaders, and CAB or ZIP archives, then executed via **DLL side-loading** through legitimate applications. Reporting on Brazilian financial malware also highlighted DLL hijacking and side-loading as a recurring technique in the broader ecosystem of banking threats operating in the region. Beyond credential theft, Ousaban includes backdoor functions such as keylogging and simulated mouse and keyboard actions, enabling operators to interact directly with infected systems. Recent campaigns used multistage components including encrypted injectors, downloaders, configuration files, and a support module that changed RDP and firewall settings and created a new administrative account for follow-on access. The malware stored remote configuration data on public services including **YouTube** and later **Google Docs**, while command-and-control traffic was protected with **AES** encryption over **RealThinClient**; researchers also noted code and operational overlaps with other Latin American banking trojans including **Grandoreiro, Amavaldo, Mispadu, Vadokrist, Mekotio, Casbaneiro,** and **Guildma**.
Aug 14, 2026