Key points
- The campaign targeted Latin American users in August 2026 via phishing emails containing malicious PDFs disguised as invoices or legal notices.
- Casbaneiro remains inactive during standard sandbox analysis, initiating command-and-control communication only when the victim visits a targeted bank website.
- FortiGuard Labs reported that the malware harvests Outlook email data and transmits it unencrypted to separate endpoints before banking triggers occur.
The short version
- Attackers distributed phishing documents to users in Argentina, Peru, Colombia, and Mexico during August 2026.
- The trojan employs conditional command-and-control activation, staying dormant until the infected user visits a specific financial website.
- It collects Outlook address book entries and email metadata, sending this data to secondary servers while the main payload waits for a trigger.
The details
A Casbaneiro banking trojan campaign operated in August 2026, focusing on users across Latin America. According to GBHackers, the attackers used phishing emails containing malicious PDF files disguised as invoices or legal notices. These documents included recipients’ email addresses to enhance credibility and create urgency regarding payments or legal proceedings. The targeting covered Argentina, Peru, Colombia, and Mexico.
The malware’s defining characteristic is its conditional command-and-control activation. It initiates banking-related communication only when the victim visits targeted financial websites. This behaviour makes infected systems appear inactive during automated sandbox analysis. FortiGuard Labs stated in a report shared with GBhackers that this restriction complicates infrastructure analysis and detection.
Before the banking trigger occurs, Casbaneiro performs other malicious activities. It harvests Outlook address-book entries and email sender and recipient information. The malware transmits this collected data without encryption to separate endpoints. A file in the %APPDATA% folder marks when this email theft is completed. Another endpoint receives Base64-encoded victim information and returns an HTTP 403 Forbidden response.
The context
The initial infection vector involves malicious links that lead to geofenced webpages. Visitors outside the targeted country are redirected to legitimate services such as Google or YouTube. This geographic filtering helps obscure the campaign’s true scope. The retrieved content is an XML-based script package containing JScript.
This script uses Windows Management Instrumentation to check for sandbox environments and identify the operating system’s language. After these checks succeed, the downloader retrieves a legitimate AutoIt interpreter, a compiled script, and a compressed payload. These components are stored in a randomly named directory. FortiGuard Labs noted that separating these components makes their combined malicious functionality harder to recognise through isolated static inspection.
The AutoIt loader displays a fake Windows service window. It decompresses a file marked with a crT suffix and injects Casbaneiro into RegSvcs.exe. If that fails, it falls back to mobsync.exe. A shortcut in the Startup folder provides persistence, while a folder under %PUBLIC% records the infection status.
Casbaneiro decrypts configuration strings assembled from fragments and creates a mutex. It rejects systems configured with German, French, or English as their default language. This language check ensures the malware only operates in the intended target regions.
Defender's checklist
Security teams should monitor for unusual network connections to secondary endpoints that return HTTP 403 Forbidden responses. Analysts should look for processes injecting into RegSvcs.exe or mobsync.exe, especially when accompanied by fake Windows service windows.
Investigating randomly named directories containing compressed payloads and AutoIt interpreters is crucial. Teams should also check for shortcuts in the Startup folder and files in %PUBLIC% that may indicate infection status. Monitoring for unencrypted data exfiltration from Outlook clients can reveal early-stage activity before the banking trigger occurs.
Background: Phishing
Phishing is a broad, automated attack sent to thousands of recipients using generic templates. Spear phishing targets specific individuals or organisations using researched personal details. The core difference lies in the level of personalisation. You defend against phishing with technical filters and against spear phishing with verification protocols and human awareness.
Read the full guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
What to do and how to stay safe: Casbaneiro
- Monitor network logs for connections to endpoints that return HTTP 403 Forbidden responses, which may indicate Casbaneiro’s secondary data exfiltration channel.
- Inspect systems for processes injecting into RegSvcs.exe or mobsync.exe, particularly if they are accompanied by fake Windows service windows.
- Review Startup folder entries and %PUBLIC% directories for new shortcuts or files that could signal persistence mechanisms used by this trojan.
- Once the vendor provides an update, ensure all systems are patched to mitigate potential exploitation of the identified infection vectors.
Step-by-step guide: EDR Misconceptions: Why Endpoint Detection Fails Without Context
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which countries were targeted by this Casbaneiro campaign?
The campaign targeted users in Argentina, Peru, Colombia, and Mexico during August 2026.
How does Casbaneiro evade sandbox analysis?
It uses conditional command-and-control activation, remaining dormant until the victim visits a targeted financial website, making it appear inactive in automated tests.
What data does the malware collect before the banking trigger?
It harvests Outlook address-book entries and email sender and recipient information, transmitting this data unencrypted to separate endpoints.
