Casbaneiro Malware Hides C2 Until Victims Visit Banking Sites

Key Takeaways

• Casbaneiro, a sophisticated Windows banking trojan, employs a multi-stage infection process that delays its primary command and control (C2) communication until a victim accesses a targeted banking website.
• The malware leverages geographic filtering, phishing emails, and multiple server interactions to evade detection and analysis, predominantly targeting users in Latin American countries such as Argentina, Peru, Colombia, and Mexico.
• Initial data exfiltration, including Outlook contacts, occurs stealthily before the main C2 channel is activated, making early analysis challenging.
• Defenders should focus on correlating email, endpoint, and network events, monitoring for unusual AutoIt script execution, and exercising caution with HTTP 403 responses from suspicious servers.

Casbaneiro Malware Employs Stealthy C2 Activation Triggered by Banking Site Visits

The Casbaneiro banking trojan has been observed utilizing an advanced evasion technique, deferring its primary command and control (C2) traffic until an infected user navigates to a specific banking website. This strategy allows the malware to maintain a low profile, complicating detection efforts by security analysts.

This Windows-based banking trojan orchestrates a complex attack chain involving deceptive phishing emails, IP-based geographical checks, phased payload delivery, and the use of distinct servers for various data collection activities. This distributed architecture is designed to make an active infection appear benign during routine security assessments, as detailed in a technical report published by Fortinet’s FortiGuard Labs.

The campaign primarily targets individuals within Latin American countries, with observed activity spanning Argentina, Peru, Colombia, and Mexico. A critical aspect of its operational stealth is its timing: sensitive information can be exfiltrated from a compromised system even before the main C2 channel becomes active. Consequently, the absence of immediate C2 traffic should not be interpreted as an indication of malware inactivity. Researchers at Fortinet’s FortiGuard Labs initially identified this sophisticated campaign in August 2026.

In their September 10 report, researcher Rachael Liao elucidated how Casbaneiro meticulously compartmentalizes its malicious operations. Email credential harvesting, victim registration, and remote control functionalities are distributed across separate server infrastructures. This segmented design intentionally obfuscates the overall attack chain, making it more difficult for security professionals to piece together the full scope of the compromise.

Initial Infection and Evasion Tactics

The attack typically commences with phishing emails containing malicious PDF attachments. These emails are crafted to mimic legitimate invoices or legal notifications, often including urgent calls to action, such as demands related to court proceedings. Some lures enhance their credibility by personalizing messages with the recipient’s email address, thereby increasing the likelihood of interaction with a malicious link embedded within.

Clicking the malicious link directs the victim to a web page that performs an IP address geolocation check. If the visitor’s IP address falls outside the campaign’s target regions, they are redirected to benign websites like Google or YouTube. This regional filtering mirrors tactics observed in other banking malware, such as Grandoreiro, which uses location-based checks to restrict payload delivery and prevent exposure to researchers operating outside the intended geographical scope.

For visitors within the targeted geographical areas, the webpage delivers a ZIP archive, with its contents encoded in Base64 within JavaScript. This script initiates a download via the browser’s standard download interface, subsequently redirecting the user to a blank page. This sequence is designed to minimize suspicion, providing the victim with fewer immediate clues that a malicious download has occurred.

The downloaded ZIP archive contains an HTA (HTML Application) file, a Windows application format capable of executing scripts. This HTA file then loads external JavaScript, which, in turn, retrieves an XML script package containing JScript. This code incorporates Windows Management Instrumentation (WMI) queries to detect virtualized or sandbox environments and verify that the operating system’s language matches a predefined list, further enhancing its evasion capabilities.

Upon successful completion of these environmental checks, the downloader retrieves three distinct components: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed payload. This modular approach hinders analysis, as examining individual components in isolation may not reveal their full malicious intent.

AutoIt Loader and Persistent Infection

The use of randomly generated filenames for these components further complicates tracking and analysis. The separation of components also serves to weaken file-level analysis, as their combined malicious behavior may not be evident when each file is inspected independently.

To establish persistence, a shortcut is created in the Windows Startup folder, ensuring the AutoIt script executes each time the user logs in. The loader displays a convincing, yet fake, Windows service window before decompressing the final payload and injecting it into either RegSvcs.exe or, as a fallback, mobsync.exe. This technique, including the use of AutoIt components and Startup shortcuts, has also been observed in activities linked to the Horabot banking trojan.

Casbaneiro decrypts its configuration settings using an algorithm similar to that employed by Ousaban. It reconstructs fragmented encrypted strings and keys only when necessary. The trojan also includes a check to reject systems where the default language is German, French, or English. While this shared algorithm is noteworthy, it does not definitively establish a common operator between the Casbaneiro and Ousaban campaigns.

The trojan actively collects address book contacts, sender details, and recipient information from Microsoft Outlook messages, transmitting this data unencrypted. It also generates a unique victim identifier by hashing the computer name, username, and executable name using MD5, and employs local markers to prevent redundant data collection. Intriguingly, another server receiving Base64 encoded victim information is configured to return an HTTP 403 Forbidden status. Casbaneiro treats this 403 response as the expected confirmation of successful data receipt, retrying only if it receives a different HTTP status. This deceptive behavior can mislead analysts into believing the infrastructure is inactive or non-functional, thereby missing a crucial part of the attack chain.

The pivotal moment for the main C2 communication is a user’s visit to a specific, targeted banking website. Once triggered, the C2 server can issue a range of commands, including keyboard control, clipboard manipulation, file execution, command execution, and the display of fake banking windows. This behavior underscores why security tests that do not simulate visits to targeted banking pages may fail to detect the full spectrum of Casbaneiro’s capabilities, a characteristic also seen in Ousaban’s banking session attacks.

Fortinet’s analysis also revealed anomalies in network traffic, such as HTTP requests lacking a Host header, unusually large Content-Length values, and message bodies fragmented into numerous small packets. These irregularities are designed to complicate network traffic inspection and analysis.

What You Should Do

• Enhance Email Security: Implement robust email filtering solutions to detect and block phishing attempts, particularly those impersonating invoices or legal notices.
• Endpoint Protection: Ensure antivirus and endpoint detection and response (EDR) solutions are up-to-date and configured to detect the Casbaneiro payload and associated malicious scripts. Fortinet reports its antivirus service detects the campaign’s phishing PDFs, malicious JavaScript, and the Casbaneiro payload.
• Network Monitoring: Correlate email, endpoint, and network events to identify suspicious activity. Pay close attention to unexpected AutoIt script execution and the creation of new shortcuts in Windows Startup folders. Do not assume HTTP 403 responses from suspicious servers indicate harmlessness; investigate them thoroughly.
• User Awareness Training: Conduct regular cybersecurity awareness training for employees, emphasizing the risks of phishing emails and the importance of scrutinizing unexpected attachments or links, especially those related to invoices or legal matters.
• Incident Response: Utilize the provided Indicators of Compromise (IoCs) to proactively search for signs of infection within your environment.

File Hashes

Source: Fortinet’s published file indicators.

Network Indicators

Fortinet provides the following domains and IP addresses, noting that specific roles (e.g., delivery, data theft, C2) are not assigned to each entry individually in their analysis.

Source: Fortinet’s published network indicators.

Cryptocurrency Addresses

Source: Fortinet’s published cryptocurrency indicators.

Host Artifacts and Detection Names

The following artifacts were identified in Fortinet’s technical analysis. Note that placeholder values will vary across infected systems, and legitimate Windows process names are only indicative of suspicious behavior when observed in conjunction with other anomalous activity.

Artifact	Value or location	Purpose or relevance
Download directory	C:{random name}	Stores the downloaded components
Compressed file suffix	crT	Helps the AutoIt loader locate the compressed payload
Startup shortcut	LNK file in the Windows Startup folder	Runs the AutoIt script through its interpreter
Infection marker folder	%PUBLIC%{ComputerName}@4{UserName}	Prevents repeated execution or reinfection
Mutex	GlobolID-4465173{Username}	Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources. Tags: AttackMalwarephishingThreat Share Article Link Copied! Jennifer sherman Jennifer is a cybersecurity news reporter covering data breaches, ransomware campaigns, and dark web markets. With a background in incident response, Jennifer provides unique insights into how organizations respond to cyber attacks and the evolving tactics of threat actors. Her reporting has covered major breaches affecting millions of users and has helped organizations understand emerging threats. Jennifer combines technical knowledge with investigative journalism to deliver in-depth coverage of cybersecurity incidents. Previous Post FBI Arrests Suspected ShinyHunters Hacker for FBIJobs.gov Breach Next Post Nippon Columbia Data Breach Exposes 8.7 Million Customer Records No Comment! Be the first one. Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * Save my name, email, and website in this browser for the next time I comment. Related Posts By Jennifer sherman Threats GlassWorm Attacks macOS via Malicious VS Code… January 1, 2026 By Emy Elsamnoudy Attacks ClickFix Attack Hides Malicious Code via Stegan Security January 1, 2026 By Sarah simpson Vulnerabilities MongoBleed Detector Tool Released to Detect MongoDB Vulnerability(CVE-2025-14847) January 1, 2026 By Emy Elsamnoudy Breaches Conti Ransomware Gang Leaders & Infrastructure Exposed January 1, 2026