A stealthy banking trojan called Casbaneiro has adopted a new tactic: it avoids any visible command-and-control (C2) traffic until an infected user visits a targeted bank’s website. Detected in Latin America—specifically Argentina, Peru, Colombia, and Mexico—this Windows malware keeps a low profile until it triggers its full suite of attacks. It was uncovered in August 2026 by Fortinet’s FortiGuard Labs in a detailed report released September 10.
How Casbaneiro’s Infection Chain Works
Casbaneiro starts with social engineering via phishing emails and PDFs masquerading as urgent legal or invoice notices. These messages often include the target’s email address to seem more credible. Clicking the link leads to a webpage that immediately checks the visitor’s IP address. If the user is outside the target region, they’re redirected to benign sites like Google or YouTube. But if they’re in one of the intended countries, they receive a specially crafted ZIP archive encoded in Base64 and hidden inside JavaScript. The archive is then downloaded via the browser, which redirects the user to a blank page—an effort to raise as little suspicion as possible.
Inside the ZIP is an HTA file, which pulls in JavaScript to fetch an XML package containing JScript. Before moving forward, Casbaneiro performs checks using Windows Management Instrumentation (WMI) to avoid sandbox environments and only proceed if the system language matches a preapproved list. Next, it downloads three components: an AutoIt interpreter, a compiled AutoIt script, and a compressed payload. To persist, it adds a shortcut to the Startup folder so it runs again on user login. It also displays a fake Windows service window briefly before injecting the payload into RegSvcs.exe—or into mobsync.exe if that primary service is missing.
What Gets Stolen, What’s Hidden
Casbaneiro harvests data from Outlook by grabbing address book contacts and email metadata. It also creates a ‘victim profile’ by hashing system identifiers like computer name, username, and executing program. Importantly, it stores some data unencrypted and sends others in Base64 format. Beforethe C2 channel fully engages, the malware tests whether the server returns an HTTP 403 Forbidden status. That’s treated as expected; many defenders might misinterpret 403s as harmless, but Casbaneiro uses them as signals. Only after the user visits a specific banking website does Casbaneiro initiate its full remote control capabilities—keylogging, clipboard hijacking, executing files, and showing fake banking windows.
Its infection chain also includes language-based filtering: systems configured in English, German, or French are blocked. Settings and configuration values are decrypted only when needed, using a fragmented algorithm shared with another malware family named Ousaban, though shared algorithms don’t necessarily mean shared operators.
Detection Challenges and IoCs
Casbaneiro uses random file names, sneaky binaries, and layered infrastructure to make detection difficult. Its network behaviors include odd HTTP requests without a Host header, unusually large Content-Length values, and data broken into many small packets—all tactics that can evade traditional detection.
Indicators of compromise (IoCs) have been published: dozens of file hashes for PDFs, HTAs, AutoIt scripts and the payload; network domains hosted on “secureserver.net” and others; a couple of cryptocurrency wallet addresses; and artifacts like mutexes, folder markers, and registry keys. Fortinet’s antivirus engine already detects the phishing PDFs, malicious JavaScript, and the Casbaneiro payload itself.
Recommended defenses include improving email filtering, keeping AV and OS systems up to date, training employees to be cautious with invoice- or legal-themed messages, and correlating email, endpoint, and network data to spot odd AutoIt execution or suspicious startup shortcuts. Security teams should also treat HTTP 403 responses carefully rather than assuming a remote server is dead.
Why it matters: Casbaneiro isn’t just another banking trojan—it’s built to evade most standard detection until the moment a user visits a bank’s website. That makes it a dangerous sleeper threat that can fly under the radar for months. In the arms race between attackers and defenders, this one raises the bar for what counts as “normal” network behavior. Going forward, defenders need to adapt: looking for suspicious components in email, unexpected AutoIt activity, and using more fine-grained visibility across endpoint and network layers will be essential to catching it. What to watch: improved threat intelligence sharing in Latin America, enhanced AV detections, and possibly more campaigns using region-based stealth tricks like those Casbaneiro now relies on.
