Loading story…
The Bizarro banking Trojan, long associated with Brazilian cybercrime, expanded its operations to victims in Spain, Portugal, France, Italy, Germany, Argentina, Chile, and Brazil, broadening a campaign focused on stealing online banking credentials and enabling fraud. Researchers said the malware was delivered through spam emails that pushed victims to download MSI installers, which then retrieved additional payloads from compromised websites, hacked WordPress servers, and cloud-hosted infrastructure on Azure and AWS.
Once installed, Bizarro used heavy obfuscation and a backdoor supporting more than 100 commands to disrupt browser sessions, capture screens, log keystrokes, and hijack clipboard data. The operators also relied heavily on social engineering, displaying fake banking pop-ups, bogus security-update prompts, and requests for two-factor authentication codes, while also using malicious QR codes that could redirect victims to Android malware to extend the fraud chain beyond desktop systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The reference reports that recent Bizarro samples use evolved protection and obfuscation techniques, while detailing the malware's spam-delivered MSI installers, staged payload downloads, banking-session disruption, credential theft, clipboard hijacking, keylogging, and social-engineering features.
Bizarro was observed targeting users in Spain, Portugal, France, Italy, Argentina, Chile, Germany, and Brazil, with attempts to steal credentials from customers of 70 banks across Europe and South America.
The reference identifies Bizarro as a banking Trojan family originating from Brazil before expanding to other regions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
Researchers detailed **Zumanek**, a Brazilian banking malware family that uses a multi-stage infection chain to steal credentials from victims of online banking and cryptocurrency services. The malware was observed almost exclusively in Brazil and begins with a socially engineered downloader that verifies the system is configured for Brazilian Portuguese, checks for installed security products, retrieves a ZIP payload from its command-and-control infrastructure, and launches the final banker and remote-access trojan stage. The final payload abuses **DLL hijacking** by pairing a legitimate signed executable with a malicious DLL, then establishes persistence, injects into `notepad.exe`, and redirects targeted banking activity into Internet Explorer for credential theft through form grabbing. Zumanek communicates with its C2 over HTTP POST requests and multiple sockets, and supports a broad set of remote-control functions including screenshots, browser manipulation, and actions associated with keylogging, underscoring continued evolution in Brazilian financial malware.
Aug 14, 2026
Researchers reported that the **BBTok** banking Trojan has been actively targeting users in **Brazil and Mexico**, impersonating more than 40 banks to steal **2FA tokens**, payment card data, and other banking credentials. The malware campaign uses strong geo-fencing and customized delivery chains that adapt lures to a victim’s country and Windows version, helping operators reduce detection while focusing on regional banking customers. Earlier reporting also documented BBTok activity in Mexico, indicating the malware family has remained active across multiple years. Check Point said the operators rely on layered obfuscation and **living-off-the-land binaries** to deploy payloads, including infection chains that use **LNK files**, a renamed `cmd.exe`, **MSBuild**, SMB-hosted XML, and downloader DLLs such as **Trammy** and **Gammy**. Analysis of older server-side artifacts showed the operation has evolved since at least 2022, with experimentation involving **Follina** and **XLL-based** vectors, while server comments and artifacts suggest with high confidence that the threat actors are Brazilian. The campaign was assessed to have targeted hundreds of users and also supports broader remote-control functions beyond credential theft.
Aug 14, 2026