A fresh banking Trojan campaign named Casbaneiro is targeting Windows users in Latin America, lying dormant until victims visit specific bank websites. First spotted by Fortinet in August 2026, the malware has hit Argentina, Peru, Colombia, and Mexico, using sharpened phishing tactics like fake invoices or legal notices to bait users into downloading malicious files. Once running, it harvests data, waits for users to visit a bank site, then springs into action.
How Casbaneiro Operates
The infection chain starts with email messages containing personalized PDFs that mention the recipient’s email address and demand urgent action—such as paying an invoice or responding to a legal matter. The PDF directs users to click a link that checks their IP address. If they’re outside Argentina, Peru, Colombia, or Mexico, they’re redirected to harmless sites. Those inside receive a Base64-encoded ZIP file that begins the malware delivery.
Inside that ZIP, an HTA file loads additional scripts and checks system properties like the OS language and signs of a virtual analysis setup. If those checks pass, Casbaneiro downloads a legitimate AutoIt interpreter, executes malicious scripts, and finally extracts its core payload by injecting it into system processes like RegSvcs.exeor mobsync.exe. It also ensures persistence by creating Startup shortcuts. Victims see a fake service window that disguises the malware’s presence.
Data Exfiltration & Clandestine Fraud
After infiltrating the system, Casbaneiro collects Outlook sender/recipient information and address-book contents, then uploads them to separate servers unencrypted. It also builds a unique fingerprint from the device’s host name, user name, and executable name so repeated actions are avoided.
The Trojan lies dormant until the victim opens one of the targeted banking sites. Then it initiates communication with its command-and-control (C2) infrastructure and receives instructions for actions such as keyboard input, clipboard manipulation, file execution, and arbitrary commands. It may also present fake windows mimicking bank processes during active online banking. For web traffic indicators, the malware issues Base64-encoded victim data; oddly, the C2 server responds with HTTP 403 errors as a ruse. Other status codes trigger retries. The campaign also uses malformed HTTP requests and varying data to confuse detection systems.
How to Spot It & Protect Yourself
Defenders are urged to treat urgent-seeming emailed invoices and legal statements as suspect, especially those that push you to open PDF attachments or enable HTA files. Disallowing HTA execution, watching for unusual AutoIt use, spotting unexpected Startup folder shortcuts, and finding odd browser-triggered outbound traffic or spoofed 403 responses in your network logs are all signs of compromise.
The article offers several specific indicators of compromise (IoCs) tied to this campaign— including SHA-256 hashes for the malicious PDFs, HTA downloaders, and the core Trojan payload, as well as IP addresses and domains used by its infrastructure.
As Latin America continues to be a hot spot for banking malware, Casbaneiro’s stealthy tactics—like regional filtering, staged payloads, and timed traffic—make it harder to detect with traditional tools.
Final thoughts:Casbaneiro demonstrates growing sophistication in banking Trojans: patience until the right moment, targeted regional scope, and use of legitimate tools to obfuscate its architecture. Victims are unlikely to notice signs until damage begins. Organizations in affected regions must harden email filtering, disable risky file types, and train employees to spot phishing urgency. Globally, this attack raises the stakes for real‐time monitoring and response visibility.
Why this matters:Casbaneiro isn’t just another banking Trojan—it shows what happens when attackers combine localization, social engineering, and delayed activation. The biggest danger? Once the trigger is pulled, sensitive financial interactions are already compromised. Watch for more campaigns like this. Tools that once made life easier—PDFs, AutoIt interpreters—are being weaponized at scale, and defenders need to act accordingly.
