Casbaneiro Malware Delays C2 Communications Until Banking Sites Are Visited
The Casbaneiro banking trojan employs a sophisticated evasion technique, delaying command and control (C2) traffic until a victim visits a targeted banking website, making it difficult to detect.
The Casbaneiro banking trojan has been observed employing a sophisticated evasion technique that delays its command and control (C2) communications until an infected user visits a targeted banking website. This Windows-based malware, active primarily in Latin America, utilizes a multi-stage infection process involving phishing emails, location-based filtering, and staged downloads to remain stealthy. Researchers from Fortinet's FortiGuard Labs identified the campaign in August 2026, detailing how the malware separates its various functions—data collection, victim registration, and remote control—across different servers, significantly complicating analysis and attribution.
The infection chain typically begins with phishing emails containing PDF attachments that impersonate invoices or legal notices, designed to create a sense of urgency. Some of these lures are personalized with the recipient's email address, aiming to increase their perceived legitimacy. The malicious link within these emails directs users to a webpage that performs an IP address check. Visitors from outside the targeted regions are redirected to benign websites like Google or YouTube, a tactic reminiscent of other banking trojans that use regional filtering to limit exposure and analysis.
Users within the targeted regions are presented with a webpage that initiates the download of a ZIP archive, encoded in Base64 within JavaScript. This download is disguised as a standard browser download, followed by a redirect to a blank page to minimize suspicion. The downloaded archive contains an HTA file, which can execute scripts. This HTA file then fetches an external JavaScript, which in turn retrieves a JScript package. This JScript leverages Windows Management Instrumentation (WMI) to perform checks for sandbox environments and verify that the operating system's language is set to an approved list, further evading automated analysis.
Once these checks are passed, the malware downloads three distinct components: a legitimate AutoIt interpreter, a compiled AutoIt script, and the final compressed payload. These components are given random filenames to hinder tracking, and their separation makes it harder for analysts to piece together the full infection chain by examining individual files. A shortcut placed in the Startup folder ensures the AutoIt script runs automatically upon user login.
The AutoIt loader then displays a fake Windows service window before unpacking the payload. This payload is subsequently injected into legitimate system processes, such as RegSvcs.exe or mobsync.exe, to blend in with normal system activity. The malware also decrypts its configuration settings using an algorithm shared with the Ousaban banking trojan, though this does not necessarily indicate a shared operator. It collects Outlook contacts and email sender/recipient details, sending this information unencrypted.
A key characteristic of Casbaneiro is its delayed C2 communication. Stolen information is sent to a server that responds with an HTTP 403 Forbidden error, which the malware interprets as a successful data exfiltration. This deliberate misdirection can lead analysts to believe the infrastructure is inactive or misconfigured. Only when a victim accesses a targeted banking website does the malware initiate its main C2 exchange, enabling commands such as keyboard control, clipboard manipulation, file execution, and the display of fake banking login pages.
Fortinet also noted unusual network traffic patterns, including HTTP requests without a Host header, abnormally large Content-Length values, and data transmitted in numerous small packets, which can complicate network traffic inspection. To defend against such threats, organizations are advised to integrate email, endpoint, and network security events, monitor for unexpected AutoIt execution and Startup shortcuts, and avoid dismissing HTTP 403 responses as definitive signs of harmless infrastructure. Strengthening email filtering, maintaining up-to-date antivirus protection, and educating users about suspicious invoice or legal messages are also crucial mitigation steps.