Casbaneiro Banking Trojan Campaign Targets Latin American Users
A sophisticated campaign utilizing the Casbaneiro banking Trojan has emerged, primarily aiming at users across Latin America. This operation, observed in August 2026, employs advanced techniques such as phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to effectively camouflage its malicious activities.
The targets of this operation predominantly encompass victims located in Argentina, Peru, Colombia, and Mexico. Cybercriminals deploy phishing tactics by sending fake invoice and legal-notice emails containing links to malicious PDF files. These deceptive communications mark a significant evolution in Latin American banking malware strategies, as they move beyond the traditional tactics of simple credential theft.
The Casbaneiro malware uniquely integrates localized social engineering tactics with a sophisticated malware framework. This includes process injection, fake banking interfaces, and conditional C2 activation to effectively minimize its presence within endpoint and network defenses. The malicious PDFs often feature embedded links, and in some instances, they incorporate the recipient’s email address to enhance credibility and increase the likelihood of user engagement.
Upon interaction with the harmful link, victims are directed to a geofenced landing page that filters requests based on geographic location. Individuals accessing the link from IP addresses outside the targeted countries are redirected to benign websites, such as Google or YouTube, thereby obscuring the malicious intent. Conversely, users located within the designated regions receive a ZIP archive whose contents are Base64-encoded and embedded in JavaScript. This script is programmed to initiate the download through the browser and subsequently redirect the victim to a blank page, further masking the activity as if it were a standard document download.
Once the ZIP archive is opened, it contains an HTA downloader that fetches external JavaScript and an XML-based script package. This process employs Windows Management Instrumentation to scrutinize the victim’s environment, capable of identifying elements such as sandboxing conditions and the operating system’s language.
FortiGuard Labs researchers have indicated that the initial stages of the attack commence with phishing emails designed to invoke a sense of urgency, often using themes related to unpaid invoices or legal proceedings. Such tactics play on the emotions of the targets, increasing the likelihood of interaction.
The execution of malicious code proceeds only when the host computer’s language aligns with the predefined targeting parameters set by the malware operators. Following this validation, the downloader retrieves three primary components into a randomly named directory on the infected machine: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed file containing the final malware payload, marked with a .crT suffix.
To prevent redundant attacks, Casbaneiro establishes a host-specific directory under the %PUBLIC% folder, utilizing a format based on the computer and user names. This informative naming convention helps identify infected machines and avoid repeated infections.
When activated, the AutoIt component simulates a legitimate Windows service window, decompresses the Casbaneiro payload, and injects it into the RegSvcs.exe process. If this process is unavailable, it directs the injection to mobsync.exe instead. This approach helps Trojan operators replicate benign behavior, further evading detection.
Casbaneiro’s capacity extends beyond data collection from the victim’s address book. The malware extracts sender-recipient information from Microsoft Outlook messages and transmits this unencrypted data to an exfiltration endpoint. Notably, a separate server is established to receive Base64-encoded victim information, which purposefully responds with an HTTP 403 Forbidden status. This crafted response is crucial; while typically signaling failed access, in this scenario, it signifies an expected result within the malware’s workflow.
This strategic method limits observable artifacts while creating local filesystem and registry markers exclusively after receiving the anticipated 403 response, thereby reducing superfluous traffic.
The C2 channel, critical for the malware’s functionality, is not activated immediately post-infection. Instead, it awaits the victim to visit a targeted banking website. Upon confirming this visit, it transmits an initial C2 packet that facilitates instructions related to bank-targeted fraud. Commands supported include keyboard control, clipboard manipulation, file execution, and the operation of fake windows that impersonate genuine banking interfaces.
Casbaneiro’s distinct operational tactics include overlay-style fraud and clipboard replacement, which can deceive victims into unknowingly submitting sensitive information into fraudulent windows. By dispersing stolen data across various servers and controlling the timing of traffic initiation, the operators significantly complicate later correlation efforts for cybersecurity analysts sifting through numerous telemetry data points.
Researchers have identified additional tactics employed, such as malformed HTTP requests lacking a Host header, which carry unusually large Content-Length values and fragmented payloads exchanged through smaller packets, further hindering conventional network inspection.
To combat this sophistication, FortiGuard has designated the campaign’s components with specific detection labels, including PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr, and W32/Casbaneiro.EN!tr.spy. Organizations with users in Latin America are urged to prioritize robust phishing filtering, closely monitor for HTA and AutoIt executions, investigate any unexpected Startup-folder LNK files, and maintain alertness on browser-triggered connections to suspicious infrastructures following visits to financial websites.
As the threat landscape evolves, particularly with regards to localized campaigns like Casbaneiro, vigilance, and proactive defense measures are paramount in safeguarding users against such increasingly refined cyber threats.