Loading story…
A high-severity Casbaneiro banking-trojan campaign is targeting Microsoft Windows users in Latin America through phishing emails masquerading as invoices and legal notices. The messages deliver a multi-stage infection chain involving an HTA downloader, an AutoIt interpreter and loader, and a final payload injected into legitimate Windows processes such as RegSvcs.exe or mobsync.exe; persistence is established through a Startup-folder LNK file.
The malware activates command-and-control activity after victims visit targeted banking sites and enables financial fraud through clipboard manipulation and fraudulent windows. It also harvests Outlook address-book data and email metadata, sending it unencrypted to multiple attacker-controlled data-receiving servers. Casbaneiro evades analysis through fragmented runtime string decryption and HTTP 403 responses, while avoiding systems configured in German, French, or English; defenders should prioritize blocking the campaign's published malicious domains, IP addresses, and file hashes and investigate suspicious HTA, AutoIt, and Startup-folder activity.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed Casbaneiro's bank-activation behavior, Outlook/address-book collection, process injection, Startup-folder persistence, and its use of HTTP 403 responses as an expected C2 workflow. The disclosure also identified payload and AutoIt-component hashes and campaign infrastructure including gexwalltool[.]com, x-wolverine[.]servebbs[.]com, 72[.]167[.]48[.]63, and 209[.]99[.]188[.]28.
FortiGuard Labs observed a high-severity Casbaneiro banking-trojan campaign targeting Microsoft Windows users in Latin America. The campaign used phishing emails with fake invoice and legal-notice PDF lures to deliver an HTA downloader, AutoIt loader, and injected payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecommunity.gurucul.com
Open sourcefeeds.fortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Brazilian cybercrime group tracked as **Augmented Marauder** and **Water Saci** is targeting Spanish-speaking users at organizations across Latin America and Europe with a multi-stage phishing campaign that delivers the **Casbaneiro** banking trojan and uses **Horabot** for delivery and propagation. The operation begins with court summons-themed phishing emails carrying password-protected PDF lures that direct victims to malicious links and ZIP archives, leading to execution of `HTA` and `VBS` payloads, followed by AutoIt loaders and encrypted malware components. Researchers said the malware chain includes anti-analysis checks, retrieval of additional payloads from remote servers, and dynamically generated judicial-themed PDF attachments created through a remote PHP API using random PINs. Horabot helps expand the campaign by harvesting Outlook contacts, abusing compromised email accounts, and sending new phishing messages, while the broader operation also incorporates **ClickFix** social engineering and **WhatsApp-based** distribution to evade defenses and widen infections.
Jun 29, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
ESET reported that several major Latin American banking trojan families—including **Amavaldo, Casbaneiro, Mispadu, Guildma, Grandoreiro, and Mekotio**—are distinct malware operations that nonetheless share extensive code, delivery logic, and operational techniques. Researchers said the overlap spans uncommon libraries, obfuscation methods, domain generation algorithms, string-encryption routines, and near-identical banking-trojan behavior, indicating close cooperation among financially motivated threat actors rather than coincidence. The campaigns commonly use **spearphishing attachments and links** to deliver payloads, often through **ZIP archives**, malicious documents, and **MSI installers**, with **Visual Basic–based scripts and macros** used for execution and staging. Once launched, the malware typically establishes persistence through Registry `Run` keys or Startup folders, uses DLL side-loading, and steals banking credentials through fake pop-up windows, keylogging, screenshots, and security-software discovery; ESET also noted that several of these families expanded beyond Latin America to target victims in **Spain and Portugal**.
Aug 15, 2026