Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
2
Stories per day · 30 days
2 RSS
7 stories, newest first · one card per story
Stories tagged #autoit
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
Casbaneiro banking trojan phishes Latin American users and starts banking C2 only after victims open targeted bank sites.
2
Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites
Fortinet details Casbaneiro banking Trojan campaign hitting Latin American bank customers via invoice-themed PDF phishing, with AutoIt loading, RegSvcs.exe injection, and bank-site-triggered activation.
4
Hackers Abuse AutoIt to Inject AsyncRAT Into Microsoft-Signed Windows Process
Attackers use AutoIt and an invoice-themed batch file to inject AsyncRAT into Microsoft-signed charmap.exe for stealthy remote access.
Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users
Casbaneiro banking Trojan targets Latin American bank users via phishing PDFs, geofencing, AutoIt staging, and distributed C2 servers to evade detection.
3
AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.
5
Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)
Guildma (Astaroth) malware spread via geofenced Brazilian Portuguese phishing emails, using zip archives, shortcuts, and AutoIt loaders.