Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
Casbaneiro banking trojan phishes Latin American users and starts banking C2 only after victims open targeted bank sites.
FortiGuard Labs reported an August 2026 Casbaneiro campaign targeting users in Argentina, Peru, Colombia, and Mexico with phishing emails and malicious PDF invoices. The trojan steals Outlook data early, then activates banking command-and-control only when a victim visits a targeted financial site, treating an HTTP 403 from a collection endpoint as success. Delivery uses geofenced pages, an HTA downloader, WMI sandbox and language checks, and an AutoIt loader that injects into RegSvcs.exe, with a Startup-folder shortcut for persistence. Casbaneiro shares a string-decryption routine with Ousaban, though researchers did not attribute both to the same operators.
- August 2026 campaign hit Argentina, Peru, Colombia, and Mexico.
- Banking C2 starts only when victims visit targeted bank sites.
- Outlook data is stolen before banking communication begins.
- AutoIt loader injects into RegSvcs.exe; Startup folder persists.
- Geofencing, language checks, and HTTP 403 responses hinder analysis.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1055 Process InjectionT1547.001 Registry Run Keys / Startup FolderT1114.001 Local Email CollectionT1047 Windows Management Instrumentation
- Products
- Microsoft OutlookAutoItWindows
- Malware
- CasbaneiroOusaban
- Organizations
- FortiGuard Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd | d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd PDF bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e03854722 |
| sha256 | 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 | he campaign’s operational behavior. IOCs File Type Hash PDF 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF 40d253480f752805e58c21266e40afe99afc96feea0d355732af5be |
| sha256 | 918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d043d08844f62 | 150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457 Email 918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d043d08844f62 Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 | 3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 PDF 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 Email debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556 |
| sha256 | 995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457 | 394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Email 995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d5e861fac457 Email 918dd413cceed3b8aeaa79e45d9d7b2030d73e2affa4339b8f9d0 |
| sha256 | bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 | f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd PDF bf92a287a3d79afb73a3f2d38877ec37c22a9f4a7d6ac2e0385472298f384fc8 PDF 943d63ace373ee50d074daf84d357f8e5e62ff91c829d87f566bee4 |
| sha256 | debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 | 3ee50d074daf84d357f8e5e62ff91c829d87f566bee453d715280 Email debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7c |
| sha256 | eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 | 68e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Email 995b1156562150c15970aa2d6b27f0b442d758594d820ec09d53d |
From the original article
3 min read at gbhackers.com
A Casbaneiro banking trojan campaign in August 2026 that targeted Latin American users via phishing emails and malicious PDFs disguised as invoices and legal notices. Its defining feature is conditional command-and-control activation: the malware initiates banking-related C2 communication only when victims visit targeted financial websites, making infected systems appear inactive during automated analysis.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.