Loading story…
A financially motivated phishing campaign is targeting Latin American banking and financial-services organizations with counterfeit DocuSign notices, Brazilian NFe/DANFE tax documents, and banking-themed messages. Victims are led through anti-analysis phishing pages to ZIP archives containing malicious Windows LNK shortcuts; the shortcuts launch concealed PowerShell downloaders that retrieve an NSIS installer and an unsigned HVNC payload masquerading as a Microsoft Windows Update Assistant, with legitimate-looking OpenCV and Microsoft Visual C++ DLLs used for camouflage.
The custom backdoor creates a hidden desktop for remote control and supports screen capture, simulated mouse and keyboard input, keystroke monitoring, Firefox data theft, browser redirection, and AV/EDR discovery. It persists through the Windows Startup folder and uses a custom raw-TCP C2 protocol marked by the cleartext HVNC- handshake, including observed ports 27015 and 27017; defenders can also hunt for version 1.2.0.4.71 and delivery token nfe_valid_access_key_2026_secure. Operators separate staging and C2 infrastructure and rotate payload-delivery methods while reusing the malware kit across financial lures.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Activity associated with the custom HVNC backdoor, including mutex patterns such as Global\AppUpdateHelper_* and Global\WinSvc_*, reportedly spans back to March 2026. The financially motivated campaign used fake DocuSign, Brazilian NFe/DANFE tax-document, and banking-themed lures to target Latin American banking and financial-services organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity **Casbaneiro** banking-trojan campaign is targeting Microsoft Windows users in Latin America through phishing emails masquerading as invoices and legal notices. The messages deliver a multi-stage infection chain involving an HTA downloader, an AutoIt interpreter and loader, and a final payload injected into legitimate Windows processes such as `RegSvcs.exe` or `mobsync.exe`; persistence is established through a Startup-folder LNK file. The malware activates command-and-control activity after victims visit targeted banking sites and enables financial fraud through clipboard manipulation and fraudulent windows. It also harvests Outlook address-book data and email metadata, sending it unencrypted to multiple attacker-controlled data-receiving servers. Casbaneiro evades analysis through fragmented runtime string decryption and HTTP 403 responses, while avoiding systems configured in German, French, or English; defenders should prioritize blocking the campaign's published malicious domains, IP addresses, and file hashes and investigate suspicious HTA, AutoIt, and Startup-folder activity.
Sep 16, 2026
A previously undocumented .NET-based malware, dubbed CAPI Backdoor, has been identified as the payload in a targeted phishing campaign against Russian automotive and e-commerce companies. The attack begins with spear-phishing emails containing a ZIP archive, which was first observed on VirusTotal on October 3, 2025. This ZIP file includes a Russian-language decoy document, purporting to be a notification about income tax legislation or payroll recalculation, and a malicious Windows shortcut (LNK) file. The LNK file, named identically to the ZIP archive, is engineered to execute the CAPI Backdoor DLL (adobe.dll) using the legitimate Windows binary rundll32.exe, a classic living-off-the-land (LotL) technique that helps evade detection. Once executed, the backdoor checks for administrator privileges, enumerates installed antivirus products, and opens the decoy document to distract the user while it operates covertly. The malware establishes persistence by creating a scheduled task and placing a shortcut in the Windows Startup folder, ensuring it runs on system reboot. CAPI Backdoor connects to a remote command-and-control server at 91.223.75[.]96, from which it can receive further instructions. Its capabilities include stealing data from popular web browsers such as Chrome, Edge, and Firefox, taking screenshots, collecting detailed system information, and enumerating folder contents for exfiltration. The malware also performs extensive checks to determine if it is running in a virtual machine or sandbox environment, likely as an anti-analysis measure. Infrastructure analysis revealed that one of the domains used in the campaign is linked to the Russian automotive sector, supporting the assessment that this industry is a primary target. The campaign also impacts the broader e-commerce sector within Russia, as indicated by the targeting patterns and decoy content. Seqrite Labs, which conducted the technical analysis, has provided indicators of compromise (IOCs) and mapped the attack to relevant MITRE ATT&CK techniques. The campaign demonstrates a sophisticated use of social engineering, leveraging localized decoy documents and legitimate system binaries to maximize infection success and persistence. The use of a previously unknown .NET implant highlights the evolving tactics of threat actors targeting Russian commercial sectors. Organizations in the affected industries are advised to update their security controls, educate employees about phishing risks, and monitor for the provided IOCs. The discovery underscores the ongoing threat posed by targeted phishing campaigns leveraging custom malware and advanced evasion techniques.
Jun 29, 2026
Researchers detailed ongoing activity by **Numando**, a Latin American banking trojan written in Delphi that has been active since at least 2018 and primarily targets victims in Brazil, with less frequent campaigns in Mexico and Spain. The malware is commonly delivered through spam emails carrying ZIP attachments with MSI installers, then launched via **DLL side-loading** using a legitimate application, an injector, and an encrypted payload. Once installed, Numando displays fake banking overlays to capture sensitive information and supports a broad set of backdoor functions, including simulating mouse and keyboard actions, taking screenshots, killing browser processes, and restarting or shutting down the infected machine. The malware also uses several distinctive tradecraft elements, including numeric command identifiers, decoy ZIP archives with encrypted URLs hidden in ZIP comments, BMP images used to conceal payloads in overlays, and remote configuration data stored on public services such as **YouTube** and **Pastebin**, encrypted with keys hardcoded in the binary.
Aug 14, 2026