InfoSecBulletin Cybersecurity for mankind
Casbaneiro is going after online banking users by sending fake messages that seem like urgent bills or legal papers. The campaign uses custom PDF tricks to lead people to a harmful download, risking email information, bank activity, and system details.
The Windows-based operation stays quiet until it really needs to act. Once it gets in, it waits for someone to visit a specific bank website, then it connects to its control system and can start actions meant to help with fraud.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Fortinet researchers found the activity in August 2026 and followed victims in Argentina, Peru, Colombia, and Mexico. The results show that regional filtering, staged downloads, and timed network traffic can make a banking Trojan tougher to detect during normal security checks.
Fortinet said in a report the campaign sends stolen data to different servers and uses a fake HTTP 403 response to mislead analysis. The approach creates a risk beyond one compromised account, because harvested contacts and email details can support later attacks.
Hackers Deploy Casbaneiro Banking Trojan
The attack starts with an email and a PDF that make the recipient feel rushed about a bill or a fake legal case. The documents might show the recipient’s email address, which is a trick to make it seem more real.
Similar deception appears in reports on weaponized PDF threats, where a familiar document becomes the first step toward malware delivery.
A link first looks at the visitor’s IP address. Visitors from other countries go to real sites like Google or YouTube, while targets get a page that quietly downloads a Base64-encoded ZIP file.
That location check reduces risk and lowers the chance that researchers get the same bad content. Inside the archive, an HTA file gets more script content and checks the device for analysis setups and allowed operating-system languages.
If the system works, it downloads a real AutoIt interpreter, a finished script, and a zipped part separately. This step-by-step method is similar to how AutoIt loader misuse is done, which helps malware hide its real goal.
The loader displays a fake Windows service window, takes the main program, and puts it into RegSvcs.exe or, if that’s not available, mobsync.exe. It also makes a Startup shortcut to stay on the system. This can trick the infected user into thinking the visible service prompt is real instead of fake.
Data Theft and Evasion
Once turned on, Casbaneiro unlocks its settings, gathers contacts, and looks at who sends and receives emails in Outlook. It sends this information without hiding it. It creates an ID from the computer name, user name, and program name, then uses a code of that ID to keep track of actions and prevent doing the same things again.
The Trojan does not use its main command channel right away. It waits until the victim goes to a targeted bank website. Then it sends system info and accepts commands to control the keyboard, paste from the clipboard, run files, and execute commands.
Organisations should see odd invoices and legal-notice PDFs as suspicious. They must check requests using a different method and stop downloaded HTA files from running if they can.
Related News:
