How to uncover a Horabot campaign and detect this malware

This report details the discovery and analysis of a Horabot malware campaign targeting primarily Mexican users. The attack chain begins with a fake CAPTCHA page leading to multiple stages of obfuscated scripts, ultimately delivering an AutoIT loader and a Delphi-based banking Trojan. The malware employs sophisticated encryption techniques, anti-VM checks, and a custom protocol for C2 communication. It also includes a spreader component written in PowerShell that harvests and exfiltrates email addresses to distribute phishing emails. The analysis reveals Brazilian Portuguese comments in the code, suggesting the threat actor's origin. The report provides detection opportunities including YARA rules and hunting queries to identify this threat.

• Casbaneiro: A Banking Trojan with Distributed Data-Receiving ServersMalware2026-09-10
• Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaignMalware2026-08-19
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• July 2026 Threat Trend Report on APT Attacks (South Korea)Campaign2026-08-28
• June 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-07-24