Casbaneiro Banking Trojan Delays Main C2 Activity Until Victims Visit Banking Sites

Casbaneiro, a Windows banking trojan, is targeting Latin American users in a campaign linked to Argentina, Peru, Colombia, and Mexico. Fortinet’s FortiGuard Labs identified the campaign in August 2026. Attackers use invoice and legal-notice phishing lures, geographic filtering, staged script downloads, and an AutoIt-based loader to establish persistence and inject the malware into legitimate Windows processes. Its main command-and-control channel activates only when victims visit targeted banking websites, enabling remote commands and fake banking windows.

The malware uses separate servers for email theft, victim registration, and remote control, allowing information theft before its main C2 channel becomes active. Victim registration deliberately expects HTTP 403 responses, while unusual HTTP formatting further complicates traffic inspection. Defenders should correlate email, endpoint, and network evidence: quiet C2 traffic or HTTP errors do not establish that an infection is inactive or that data theft has not occurred.