30
30
Hackers Abuse AutoIt to Inject AsyncRAT Into Microsoft-Signed Windows Process
Attackers use AutoIt and an invoice-themed batch file to inject AsyncRAT into Microsoft-signed charmap.exe for stealthy remote access.
Point Wild Threat Intelligence documented a five-stage campaign starting with 'Right-click to open Invoice Details.bat' that launches hidden PowerShell, drops a renamed AutoIt interpreter and encrypted loader into a random Temp folder, and persists via a Startup-folder batch file. The loader decrypts AsyncRAT only in memory and injects it into the Microsoft-signed charmap.exe (Windows Character Map) process, leaving no payload file on disk. The final payload patches AMSI inside the infected process and includes screen-capture code that prepares images for transfer to a command-and-control server at 158[.]51[.]122[.]136:4944.
30
AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.
Researchers at Point Wild Threat Intelligence analyzed a campaign starting from a lure batch file ('Right-click to open Invoice Details.bat') that launches hidden PowerShell to reconstruct a Base64/XOR-obfuscated payload. The stage drops a renamed signed AutoIt interpreter and loader script into %LOCALAPPDATA%\Temp and achieves persistence via a batch file in the user's Startup folder (T1547.001). The loader decrypts the payload in memory with single-byte XOR key 0x36 and injects it into SysWOW64\charmap.exe using OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, with PE-sieve confirming an in-memory implanted PE and patched AMSI modules. The final AsyncRAT payload performs screen capture and data theft, with observed C2 at 158[.]51[.]122[.]136:4944 over raw TCP.
48
45
42
30
35
30
Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites
Fortinet details Casbaneiro banking Trojan campaign hitting Latin American bank customers via invoice-themed PDF phishing, with AutoIt loading, RegSvcs.exe injection, and bank-site-triggered activation.
Fortinet identified an August 2026 Casbaneiro banking Trojan campaign targeting users in Argentina, Peru, Colombia, and Mexico through phishing PDFs styled as urgent invoices or legal notices. The staged chain uses IP-based geo-filtering, a Base64-encoded ZIP, an HTA file, and a legitimate AutoIt interpreter before injecting into RegSvcs.exe or mobsync.exe and persisting via a Startup shortcut. The Trojan exfiltrates address book and Outlook data unencrypted, stays dormant until victims visit targeted bank sites, then accepts commands for keyboard control, clipboard pasting, file execution, and command execution. It uses an expected HTTP 403 response from a second server and malformed HTTP requests to complicate network analysis.
48
57
30
35
42
57
30
30
Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users
Casbaneiro banking Trojan targets Latin American bank users via phishing PDFs, geofencing, AutoIt staging, and distributed C2 servers to evade detection.
FortiGuard Labs detailed a Casbaneiro banking Trojan campaign observed in August 2026 targeting users in Argentina, Peru, Colombia, and Mexico via fake invoice and legal-notice emails. The operation uses geofenced landing pages, an HTA downloader with WMI-based sandbox checks, a legitimate AutoIt interpreter, and process injection into RegSvcs.exe (fallback mobsync.exe). C2 activation is conditional on victims visiting banking websites, enabling keyboard control, clipboard manipulation, and fake overlay windows for bank-focused fraud, while distributed exfiltration servers and unusual HTTP 403-based signaling hinder analyst correlation.
55
55
30
35
42
57
60
New Python-Based Payload MechaFlounder Used by Chafer
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.
44
30
35
60
Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)
Guildma (Astaroth) malware spread via geofenced Brazilian Portuguese phishing emails, using zip archives, shortcuts, and AutoIt loaders.
SANS researchers documented a Guildma (Astaroth) malware infection initiated on 2026-08-31 by a malicious Brazilian Portuguese email offering a DocuSign-themed PDF. The delivery link is geofenced to Brazil and requires Brazilian Portuguese browser and OS language settings, otherwise serving a legitimate installer. The infection chain uses a zip archive containing a Windows shortcut that retrieves a DLL saved as an alternate data stream, which installs a compiled AutoIt package for persistence. Unique SHA-256 indicators and HTTPS traffic to Azure-hosted and .cfd domains were observed, with prior reports noting the campaign's abuse of GitHub.
45
Exploring the Latest Mispadu Stealer Variant
Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.
Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.
45
30
42
30
60
30
35
35
42
42
30