Loading story…
Attackers in Brazil used malicious Windows Control Panel Application files (.cpl) as downloaders to install banking Trojans, relying heavily on socially engineered email campaigns themed around local payment and tax documents such as Boleto Bancário and Nota Fiscal Eletrônica. The files abused normal Windows handling of .cpl extensions through control.exe, with malicious logic commonly embedded in the CPlApplet routine—especially the CPL_DBLCLK handler—to fetch and launch second-stage malware.
Analysis of more than 1,500 samples found that 82% were classified as Win32/TrojanDownloader.Banload, with Brazil accounting for the vast majority of detections. Many samples were written in Delphi and included string encryption, resource-based key loading, and anti-virtualization checks for Wine, VMware, and Virtual PC. The downloaded payloads were primarily banking Trojans capable of browser injection, keylogging, screenshot or mouse capture, and encrypted theft of banking credentials, showing a sustained malware ecosystem focused on Brazilian financial fraud.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
By the first quarter of 2015, CPL malware had risen to roughly three out of ten submitted executable samples in Latin America. The report presents this as evidence of the technique's sharp growth through early 2015.
In 2014, Brazil accounted for 76% of global Win32/TrojanDownloader.Banload detections, according to the report. This reflected the concentration of CPL-based downloader activity and banking-malware targeting in Brazil.
The report states that malicious CPL-file campaigns grew sharply in Latin America from 2012 through early 2015, becoming a significant malware distribution method. These campaigns primarily used socially engineered emails to deliver CPL downloaders that fetched banking Trojans.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
A high-severity **Casbaneiro** banking-trojan campaign is targeting Microsoft Windows users in Latin America through phishing emails masquerading as invoices and legal notices. The messages deliver a multi-stage infection chain involving an HTA downloader, an AutoIt interpreter and loader, and a final payload injected into legitimate Windows processes such as `RegSvcs.exe` or `mobsync.exe`; persistence is established through a Startup-folder LNK file. The malware activates command-and-control activity after victims visit targeted banking sites and enables financial fraud through clipboard manipulation and fraudulent windows. It also harvests Outlook address-book data and email metadata, sending it unencrypted to multiple attacker-controlled data-receiving servers. Casbaneiro evades analysis through fragmented runtime string decryption and HTTP 403 responses, while avoiding systems configured in German, French, or English; defenders should prioritize blocking the campaign's published malicious domains, IP addresses, and file hashes and investigate suspicious HTA, AutoIt, and Startup-folder activity.
Sep 16, 2026
Elastic Security Labs disclosed **TCLBANKER**, a Brazilian banking trojan assessed as a major evolution of the **MAVERICK/SORVEPOTEL** family, delivered through a trojanized MSI installer for Logitech's signed **Logi AI Prompt Builder** and executed via DLL sideloading. The malware targets **59** Brazilian banking, fintech, and cryptocurrency services, using anti-analysis checks, environment-gated payload decryption, ETW patching, watchdog functions, and .NET Reactor-protected modules to evade detection and maintain execution. Once active, it monitors browser activity through UI Automation and opens a WebSocket command-and-control channel when victims visit monitored financial sites. The malware's fraud tooling includes a **WPF full-screen overlay** framework that can present fake login prompts, counterfeit Windows Update screens, vishing wait pages, and screen-capture-resistant overlays to steal credentials and support operator-driven account takeover. A separate worm component propagates through **WhatsApp Web** by hijacking authenticated browser sessions and through **Microsoft Outlook** by using COM automation to send phishing emails from the victim's own account. Researchers said the campaign relies heavily on **Cloudflare Workers** for payload hosting and C2, and appears to be in an early operational stage based on exposed developer artifacts and unfinished phishing infrastructure.
Jun 29, 2026