Threats Tagged 'autoit loader'

Casbaneiro is a banking Trojan active since August 2026, targeting Latin American users via phishing emails and malicious PDFs disguised as invoices and legal notices. It uses a multi-stage infection chain with HTA downloaders and AutoIt loaders, employing geofencing to restrict infection to specific countries. The malware uses sophisticated evasion techniques such as distributed data-receiving servers, deliberate HTTP 403 responses, and activation only on targeted banking websites. It steals email data, performs clipboard injection, and creates fake windows to facilitate fraud. The campaign specifically targets Argentina, Peru, Colombia, and Mexico, while avoiding systems using German, French, or English languages. The malware complicates detection by splitting stolen data across multiple servers and using malformed HTTP packets.

MediumMalwareArgentinaColombiaMexico+1#casbaneiro#autoit loader#banking trojan