Casbaneiro Banking Trojan Targets Latin America with Evasive Tactics
A sophisticated banking Trojan named Casbaneiro is targeting users in Latin America through phishing campaigns, employing multi-stage evasion techniques to remain undetected until it initiates data exfiltration and command execution.
The Casbaneiro banking Trojan has emerged as a significant threat to online banking users across Latin America, employing a multi-layered approach to infiltrate systems and exfiltrate sensitive financial data. The campaign, identified by Fortinet researchers in August 2026, has been observed targeting victims in Argentina, Peru, Colombia, and Mexico. This sophisticated malware is designed to remain dormant until a user visits a specifically targeted bank website, at which point it springs into action to steal credentials and accept commands from its operators.
The initial vector for Casbaneiro infection involves phishing emails that impersonate urgent invoices or legal notices. These emails often contain personalized PDF lures, a tactic designed to increase their credibility and entice recipients to click on malicious links. This initial engagement triggers a staged download chain, which is carefully crafted to evade detection by security software. The malware's ability to remain inactive until a specific trigger event—visiting a banking website—makes it particularly insidious, as it can reside on a system for an extended period without raising suspicion.
Upon clicking a malicious link, the campaign first checks the visitor's IP address. Users outside the targeted Latin American countries are redirected to legitimate websites like Google or YouTube, a geo-targeting measure that limits exposure and reduces the likelihood of security researchers encountering the malicious payload. Victims within the target regions, however, are presented with a page that silently downloads a Base64-encoded ZIP archive. This archive contains an HTA file, which further fetches additional script content and performs checks on the victim's system, looking for analysis environments or specific operating system languages.
If the system passes these checks, the malware proceeds with a staged download of its components. It downloads a legitimate AutoIt interpreter, a compiled script, and a compressed payload separately. This modular approach is reminiscent of other AutoIt loader abuse techniques, allowing the malware to obscure its true purpose. The AutoIt script then displays a fake Windows service window to the user, creating a diversion while it extracts the final malicious program and injects it into legitimate Windows processes such as RegSvcs.exe or mobsync.exe. Persistence is established through a Startup folder shortcut.
Once active, Casbaneiro decrypts its configuration and begins collecting valuable information, including address book entries and details from Outlook sender and recipient fields. This data is transmitted without encryption. The malware creates a unique identifier for each infected machine based on the computer name, user name, and executable name, using a hash of this identifier to track activity and avoid redundant actions.
The true danger of Casbaneiro materializes when the victim accesses their online banking. At this point, the Trojan initiates communication with its command and control (C2) infrastructure, sending collected system information and awaiting instructions. These commands can include keyboard control, clipboard manipulation, file execution, and arbitrary command execution, enabling extensive remote control over the compromised system. The malware also features functions that can display fake windows specifically targeting certain banks, further enhancing its ability to deceive users during active banking sessions.
Casbaneiro employs several sophisticated evasion techniques to hinder analysis and detection. It uses IP filtering to limit its reach, Base64 encoding for its payloads, and a unique method of exfiltrating data. When sending stolen data, the malware receives a deliberately expected HTTP 403 (Forbidden) response from a secondary server, which it interprets not as an error, but as confirmation of successful data transfer. Any other HTTP status code prompts the malware to retry. The campaign also distributes different types of information to different servers and utilizes malformed HTTP requests, all of which complicate network-based investigations and threat hunting efforts.
To mitigate the risks posed by Casbaneiro and similar banking Trojans, organizations are advised to treat unsolicited invoice and legal notice PDFs with extreme suspicion, verifying any urgent requests through separate communication channels. Blocking the execution of downloaded HTA files where possible is also recommended. Security teams should monitor for unusual AutoIt activity, the creation of Startup folder shortcuts, unexpected browser-triggered outbound traffic, and communications that result in seemingly failed 403 responses. Comprehensive employee training on recognizing phishing attempts and prompt reporting of suspicious activity remain critical defenses against these evolving threats.