Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers

Casbaneiro is a banking Trojan active as of August 2026, targeting Latin American users through phishing emails and malicious PDFs disguised as invoices and legal notices. It uses a multi-stage infection chain with HTA downloaders and AutoIt loaders, employing geofencing to restrict infections to specific regions. The malware evades detection by distributing stolen data across multiple servers, deliberately responding with HTTP 403 to some requests, and activating only when victims visit targeted banking websites. It steals email data, performs clipboard injection, and creates fake windows to facilitate fraud. The campaign targets Argentina, Peru, Colombia, and Mexico, while avoiding systems using German, French, or English languages.

• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• 2026 Year End Phishing LuresCampaign2026-10-22