BraZetsu is a Python-based Windows malware framework used by the Brazilian threat actor Exilware. It functions as a toolkit for Initial Access Brokers, converting compromised systems into assets for sale in underground markets. The malware targets corporate, financial, industrial, and law enforcement sectors primarily in Iberia and Latin America. It harvests financial transaction files in the Brazilian CNAB format, browsing histories, and digital certificates. BraZetsu supports the 'Infected Marketplace' where initial access is sold to criminal clients for further exploitation. Since early 2026, it has rapidly evolved to include AI-enhanced reconnaissance and advanced evasion techniques. There is no indication of known exploits in the wild or available patches.
Casbaneiro is a banking Trojan active as of August 2026, targeting Latin American users through phishing emails and malicious PDFs disguised as invoices and legal notices. It uses a multi-stage infection chain with HTA downloaders and AutoIt loaders, employing geofencing to restrict infections to specific regions. The malware evades detection by distributing stolen data across multiple servers, deliberately responding with HTTP 403 to some requests, and activating only when victims visit targeted banking websites. It steals email data, performs clipboard injection, and creates fake windows to facilitate fraud. The campaign targets Argentina, Peru, Colombia, and Mexico, while avoiding systems using German, French, or English languages.
BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware, functioning as a comprehensive toolkit for Initial Access Brokers. Unlike standard infostealers, BraZetsu transforms compromised systems into commercial assets through deep reconnaissance capabilities targeting Iberian and Latin American corporate, financial, industrial, and law enforcement environments. The framework scans for standardized financial remittance files in Brazilian CNAB format, extracts detailed browser histories, and employs AI-enhanced data triage for target prioritization. Operating through a modular architecture with stealth techniques, BraZetsu powers the Infected Marketplace where Exilware commercializes initial access to compromised hosts. The platform allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect. Tracked since February 2026, BraZetsu demonstrates rapid technical progressi...
In May 2026, an attack campaign targeting banking users in Spain and Portugal was identified involving the Ousaban banking Trojan. The malware, previously active in Brazil, spreads through phishing PDFs that redirect victims to malicious webpages performing environment checks to ensure targets are located in Spain or Portugal. The attack chain involves VBS scripts downloading steganographic images containing the payload, which is then dropped and executed on victims' systems. Ousaban establishes persistence, monitors banking activity across multiple financial institutions, and uses daily-changing DDNS domains to resolve C2 server addresses. The malware employs screenshot capture, keylogging, clipboard injection, and remote control capabilities to steal banking credentials. It utilizes custom encryption algorithms and geofencing techniques to evade detection and limit exposure to intended targets.
