Threats Affecting Peru

A sophisticated phishing campaign targets YouTube content creators by impersonating well-known brands such as Hollyland, Nike, and Spotify. Attackers send personalized sponsorship emails referencing specific videos from the creators' channels, directing them to fake platforms that mimic legitimate campaign dashboards. The scam culminates in a Google sign-in prompt that either steals credentials directly or requests excessive permissions. Compromised accounts are then locked by changing recovery options and used to propagate further scams to followers. This modular campaign operates globally, with confirmed targeting in Peru, Japan, and English-speaking regions, using multiple domains with consistent design and functionality.

MediumCampaignJapanPeru#google account compromise#sso abuse#social engineering

The FamousSparrow espionage group, linked to China, has deployed a new backdoor malware named SparroWocky targeting government organizations in Latin America since mid-2025. SparroWocky is a modular C++ backdoor with advanced anti-analysis and evasion techniques, including DLL side-loading, runtime code patching, and thread creation interception to disguise malicious activity. It enables extensive system reconnaissance, file operations, screenshot capture, process creation, and network proxying. Persistence is maintained via Windows services or registry keys. The malware communicates with multiple command-and-control servers over common ports and proxies. The attacks aim to gather intelligence on Latin American governments' responses to U.S. pressure on Chinese economic interests.

HighMalwareArgentinaEcuadorGuatemala+5#malware#apt

Casbaneiro is a banking Trojan active as of August 2026, targeting Latin American users via phishing emails and malicious PDFs disguised as invoices and legal notices. It uses a multi-stage infection chain involving HTA downloaders and AutoIt loaders, with geofencing to restrict infection to specific regions. The malware employs evasion techniques such as distributed data-receiving servers, deliberate HTTP 403 responses, and activates only when victims visit targeted banking websites. It steals email data, performs clipboard injection, and creates fake windows to facilitate fraud. The campaign specifically targets Argentina, Peru, Colombia, and Mexico, while avoiding systems using German, French, or English languages. Casbaneiro complicates detection by splitting stolen data across multiple servers and using malformed HTTP packets.

MediumMalwareArgentinaColombiaMexico+1#casbaneiro#autoit loader#banking trojan

Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.

MediumMalwareUnited StatesAngolaArgentina+46#phpmyadmin#gh0st rat#china-nexus

A sophisticated fraud campaign exploiting Indonesia's tax season targeted 67 million residents through fake Coretax applications distributed via phishing websites and WhatsApp social engineering. The GoldFactory threat cluster orchestrated operations using Gigabud.RAT and MMRat malware families with shared infrastructure abusing over 16 trusted brands across government and financial sectors. The attack chain combines vishing, screen recording, and remote access capabilities to achieve device compromise and unauthorized financial transfers. Estimated financial impact reaches USD 1.5-2 million nationwide, with global implications extending to USD 6 million annually across multiple countries. The industrialized malware-as-a-service infrastructure enables horizontal scaling across Thailand, Vietnam, Philippines, and South Africa, demonstrating a shift toward unified cross-border operations that systematically undermine trust in digital government services.

MediumMalwareIndonesiaPeruPhilippines+2#goldfactory#gigabud.rat#mmrat

A BTS comeback and world-tour announcement has resulted in a new wave of scam campaigns. Kaspersky experts have discovered fraudulent websites that sell fake BTS tickets to fans all around the world. We explain what those fake pages look like, and how you can avoid getting scammed.

MediumPhishingArgentinaBrazilChile+6#web

BlueVoyant researchers have uncovered a broad, multi-pronged phishing campaign targeting Spanish-speaking users in organizations across Latin America and now Europe as well. While recent industry intelligence heavily documented attacks utilizing WhatsApp to deliver banking trojans under the umbrella of the Brazil-based eCrime group Augmented Marauder (a.k.a. Water Saci)

MediumMalwareBrazilMexicoArgentina+5#casbainero#phishing#augmented marauder

CVE-2026-30655 is a medium severity SQL injection vulnerability in the esiclivre/esiclivre application version 0.2.2 and earlier. It affects the resetaSenha() function in the Solicitante component, specifically via the cpfcnpj parameter in /reset/index.php. This flaw allows unauthenticated remote attackers to execute unauthorized SQL queries, potentially exposing sensitive information. The vulnerability does not require user interaction or authentication and has a CVSS score of 6.5. No known exploits are currently reported in the wild. Organizations using affected versions of esiclivre should prioritize patching or mitigating this issue to prevent data leakage.

MediumVulnerabilityBrazilArgentinaMexico+5#cve#cve-2026-30655

CVE-2026-4355 is a medium severity cross-site scripting (XSS) vulnerability found in Portabilis i-Educar version 2.11, specifically in the /intranet/educar_servidor_curso_lst.php file. The vulnerability arises from improper sanitization of the 'Name' argument, allowing remote attackers to inject malicious scripts. Exploitation requires no authentication but does require user interaction, such as a victim clicking a crafted link. The vendor has not responded to disclosure attempts, and no patches are currently available. Although no known exploits are in the wild, the exploit code is publicly available, increasing the risk of attacks. This vulnerability can lead to session hijacking, credential theft, or unauthorized actions within the affected web application. Organizations using i-Educar 2.11 should prioritize mitigation to prevent exploitation.

MediumVulnerabilityBrazilArgentinaChile+4#cve#cve-2026-4355

A sophisticated multi-stage infection chain targets Argentina's judicial ecosystem using spear-phishing tactics and authentic-looking judicial content. The campaign employs a carefully crafted ZIP archive containing a weaponized LNK shortcut, BAT-based loader script, and judicial-themed PDF decoy. The attack chain leads to the deployment of a Rust-based Remote Access Trojan (RAT) that demonstrates extensive anti-VM, anti-sandbox, and anti-debugging techniques. The RAT establishes a resilient command-and-control channel, supports modular commands for various malicious activities, and implements full lifecycle management. The operation, dubbed 'Operation Covert Access,' aims to secure long-term access within high-trust institutional settings, highlighting the need for improved defenses against socially engineered intrusion chains.

MediumMalwareArgentinaChileBrazil+5#spear-phishing#anti-analysis#phishing