Casbaneiro Banking Trojan Targets Latin American Banks

Key Takeaways

• Casbaneiro, a sophisticated banking Trojan, is actively targeting online banking users across Latin America, specifically in Argentina, Peru, Colombia, and Mexico.
• The attack chain begins with personalized phishing emails containing PDF lures that mimic urgent invoices or legal notices.
• The malware employs advanced evasion techniques, including geographical IP filtering, multi-stage downloads, and obfuscated command-and-control (C2) communications, making detection challenging.
• Once installed, Casbaneiro remains dormant until a victim navigates to a targeted banking website, at which point it activates to steal sensitive data and facilitate fraudulent transactions.
• The operation harvests contact and email details, posing a risk for future spear-phishing campaigns beyond initial financial fraud.

Casbaneiro Banking Trojan Deploys Sophisticated Attack Chain Across Latin America

Cybersecurity researchers have uncovered an active campaign leveraging the Casbaneiro banking Trojan to compromise online banking accounts throughout Latin America. The operation, which targets users in countries including Argentina, Peru, Colombia, and Mexico, employs a multi-stage attack that leverages social engineering and advanced evasion tactics to steal sensitive financial and personal data.

Initial Compromise and Stealthy Deployment

The attack initiates with highly convincing phishing emails, designed to appear as critical invoices or legal notifications. These emails often incorporate the recipient’s own email address to enhance their perceived legitimacy. Embedded within these deceptive messages are personalized PDF documents, serving as lures to steer unsuspecting users toward a malicious download sequence. This tactic mirrors other weaponized PDF threats, where seemingly innocuous files become the entry point for malware delivery.

Upon clicking a link within the malicious PDF, the victim’s IP address is immediately checked. Individuals located outside the designated target countries are redirected to benign websites like Google or YouTube, effectively preventing security researchers from easily acquiring the malicious payload. Conversely, legitimate targets are served a page that silently downloads a Base64-encoded ZIP archive. This geographical filtering mechanism significantly reduces the campaign’s exposure and complicates analysis efforts.

The ZIP archive contains an HTA (HTML Application) file. Executing this HTA file triggers further script downloads and performs checks for analysis environments and approved operating system languages. If the system passes these preliminary checks, it proceeds to download three separate components: a legitimate AutoIt interpreter, a compiled script, and a compressed malicious component. This staged delivery, reminiscent of known AutoIt loader abuse patterns, helps obscure the malware’s true intent and makes it more difficult for traditional security solutions to identify the combined threat.

The loader then displays a counterfeit Windows service window, a deceptive maneuver to distract the user. Simultaneously, it extracts the final Casbaneiro payload and injects it into either `RegSvcs.exe` or, if unavailable, `mobsync.exe`. To ensure persistence across system reboots, the malware also creates a shortcut in the Startup folder. These stealthy actions mean an infected user may remain unaware that the visible service prompt is a decoy, not a legitimate system process.

Data Theft and Evasion Techniques

Once Casbaneiro is fully operational, it decrypts its configuration parameters and immediately begins harvesting sensitive information. This includes address book entries and detailed sender and recipient information from Outlook, which it transmits unencrypted to its command-and-control (C2) infrastructure. The Trojan constructs a unique identifier for each compromised system using the computer name, user name, and executable name, then hashes this value to track activity and prevent redundant actions.

A critical aspect of Casbaneiro’s design is its patient approach. The Trojan does not immediately activate its primary command channel. Instead, it lies dormant until the victim navigates to one of the pre-configured, targeted banking websites. Upon detecting a visit to a banking portal, Casbaneiro initiates contact with its C2 servers, transmitting system information and awaiting commands. This allows the attackers to execute various malicious actions, including remote keyboard control, clipboard manipulation, file execution, and arbitrary command execution, specifically during an active online banking session. The malware’s ability to overlay fake windows over legitimate banking interfaces further amplifies the risk of real-time fraud.

Fortinet researchers, who first identified this activity in August 2026, detailed how the campaign utilizes a sophisticated C2 communication strategy. Stolen information is sent to a distributed network of servers. Intriguingly, one of these servers is configured to return an HTTP 403 status code upon receiving Base64-encoded victim data. Rather than indicating an error, this 403 response is an intentional part of the protocol; any other HTTP status prompts the malware to retry the transmission. This deliberate use of a seemingly failed response, coupled with sending different data to different servers and employing malformed HTTP requests, severely complicates network traffic analysis and detection by security tools. This behavior, particularly the bank-triggered activation, draws parallels to the Ousaban banking malware, another threat that waits for specific banking site visits before acting, as Fortinet said in a report shared with Cyber Security News (CSN).

The implications extend beyond immediate financial fraud. The stolen contact and email details can be leveraged for subsequent spear-phishing campaigns, broadening the scope of potential victims and perpetuating the attack cycle.

What You Should Do

• Exercise Extreme Caution with Emails: Treat any unexpected emails, especially those purporting to be urgent invoices or legal notices, with suspicion. Verify the sender and the legitimacy of the request through an independent, trusted channel (e.g., a known phone number or official website) before clicking any links or opening attachments.
• Block HTA File Execution: Configure email gateways and endpoint security solutions to block the execution of HTA (HTML Application) files downloaded from external sources, as these are a common vector for initial infection.
• Monitor for Unusual AutoIt Activity: Security teams should actively monitor for any unusual usage of the AutoIt scripting language or its interpreter on enterprise endpoints, as well as the creation of new shortcuts in the Windows Startup folder.
• Analyze Outbound Network Traffic: Implement robust network monitoring to detect suspicious outbound traffic, particularly browser-triggered communications to unknown IP addresses or domains, and analyze HTTP 403 responses for anomalous patterns that might indicate C2 activity.
• Conduct Regular Employee Training: Provide ongoing cybersecurity awareness training to employees, emphasizing the dangers of phishing, the importance of verifying urgent requests, and how to report suspicious emails or system behavior promptly.
• Review Banking Trojan Tactics: Stay informed about the latest tactics, techniques, and procedures (TTPs) employed by banking Trojans and other financial malware to better recognize warning signs.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.