Horabot Banking Trojan Resurfaces in Mexico With New Email Worm Tactics

Key Takeaways

• The Horabot banking trojan has launched a sophisticated new campaign primarily targeting users in Mexico.
• The attack chain involves a multi-stage infection, beginning with a fake CAPTCHA page that tricks users into executing malicious code, and features an email worm for self-propagation.
• The campaign has compromised over 5,300 machines, with approximately 93% located in Mexico, operating undetected for months.
• The threat actors show linguistic ties to Brazil, using Brazilian Portuguese in their code and Spanish in phishing lures.
• Defenders should focus on blocking untrusted HTA execution, monitoring for suspicious activity, and implementing provided YARA and Suricata rules for detection.

Horabot Banking Trojan Returns with Email Worm, Targets Mexico

The notorious Horabot banking trojan has re-emerged in an active campaign, primarily targeting individuals and organizations across Mexico. This sophisticated operation employs a multi-stage infection chain, notably incorporating an email worm that transforms compromised systems into relays for further phishing attacks.

This latest iteration of Horabot combines a Delphi-based banking trojan with a PowerShell-driven spreading mechanism, positioning it as one of the more intricate financially motivated threats observed in Latin America.

Initial Infection and Propagation

The attack sequence commences with a deceptive CAPTCHA page. Victims are instructed to open the Windows Run dialog and paste a malicious command. Instead of exploiting a software vulnerability, the attackers manipulate users into executing a malicious HTA (HTML Application) file. This file then silently initiates the complex infection chain.

This method effectively bypasses numerous endpoint security measures by leveraging user interaction, turning the victim into an unwitting participant in their own compromise.

Analysts at Securelist identified this campaign following an alert for suspicious mshta execution within a monitored client environment. The team subsequently traced the activity back to the fake CAPTCHA page and meticulously mapped the entire attack chain by investigating the adversary’s infrastructure.

During their investigation, researchers discovered an exposed victim log on the attacker’s server. This log revealed 5,384 infected machines, with a staggering 5,030 (approximately 93%) located in Mexico. Records indicated the operation had been active since May 2025, suggesting it ran undetected for several months prior to its discovery.

Threat Actor Profile and Tactics

Evidence strongly suggests ties between the threat actors and Brazil. Comments embedded within the spreader’s PowerShell code were written in casual Brazilian Portuguese, and the encryption key used for resource decryption includes the phrase “pega a visão,” a Brazilian slang term meaning “get the picture.” Conversely, the phishing emails distributed by the worm are expertly crafted in Spanish, designed as fake invoices or confidential business documents specifically targeting Mexican recipients.

The Delphi banking trojan, also known by other monikers such as Casbaneiro, Ponteiro, and Metamorfo, functions by displaying fake bank overlay pop-ups. These overlays are strategically deployed during active banking sessions to illicitly harvest login credentials. The associated email worm further exacerbates the threat by extracting contact addresses from the victim’s inbox via the MAPI namespace. It then sends phishing emails to these contacts, each containing a malicious PDF that initiates the entire infection cycle anew.

Multi-Stage Infection Mechanism

The distinctive feature of this campaign lies not just in its payload but in its elaborate, multi-stage delivery route. Each subsequent stage introduces an additional layer of obfuscation before the final malware is deployed.

Upon execution of the initial HTA file, it retrieves a JavaScript loader from a domain controlled by the attackers. This loader then pulls and executes an obfuscated VBScript. This particular VBScript employs server-side polymorphism, delivering a slightly varied version of its code with each request. This tactic is designed to evade signature-based detection mechanisms.

A second, more intricate VBScript, spanning over 400 lines, serves as the operational core. It systematically gathers the victim’s IP address, hostname, username, and operating system version, subsequently transmitting this data to a command-and-control (C2) server. This script also drops AutoIT components to disk, establishes persistence by creating a LNK shortcut in the Startup folder, and downloads the subsequent stage of the malware.

The AutoIT script then decrypts an AES-192-encrypted blob using a key derived from the seed value 99521487. The resulting DLL, which is the banking trojan itself, is then loaded directly into memory. This trojan communicates with its C2 server using a custom TCP protocol, encapsulating commands within structured tags. All traffic is encrypted via a stateful XOR cipher, with output framed between double "##" markers. This unique pattern is sufficiently rare in legitimate network traffic to serve as a reliable detection signature.

Analysts observed that the cipher’s rigid and repetitive structure, ironically, makes it easier to detect using standard Intrusion Detection System (IDS) rules.

What You Should Do

• Block HTA Execution: Configure endpoint security to block HTA file execution from untrusted sources.
• Monitor for Suspicious Activity: Implement robust monitoring for suspicious mshta process activity on endpoints.
• Deploy Detection Rules: Integrate the published YARA rules for both the Horabot Delphi trojan and the AutoIT loader into your security systems.
• Implement Network Signatures: Deploy Suricata rules targeting the double "##" C2 traffic pattern to detect network communications.
• Update Blocklists: Immediately add all shared indicators of compromise, including attacker-controlled domains and socket addresses, to network blocklists.
• Conduct User Awareness Training: Educate users on the dangers of fake CAPTCHA lures and the risks associated with opening suspicious PDF attachments containing embedded buttons.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.