InfoSecBulletin Cybersecurity for mankind
Casbaneiro is going after online banking users by sending fake messages that seem like urgent bills or legal papers. The campaign uses custom PDF tricks to lead people to a harmful download, risking email information, bank activity, and system details.
The Windows-based operation stays quiet until it really needs to act. Once it gets in, it waits for someone to visit a specific bank website, then it connects to its control system and can start actions meant to help with fraud.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Fortinet researchers found the activity in August 2026 and followed victims in Argentina, Peru, Colombia, and Mexico. The results show that regional filtering, staged downloads, and timed network traffic can make a banking Trojan tougher to detect during normal security checks.
Fortinet said in a report the campaign sends stolen data to different servers and uses a fake HTTP 403 response to mislead analysis. The approach creates a risk beyond one compromised account, because harvested contacts and email details can support later attacks.
Hackers Deploy Casbaneiro Banking Trojan
The attack starts with an email and a PDF that make the recipient feel rushed about a bill or a fake legal case. The documents might show the recipient’s email address, which is a trick to make it seem more real.
Similar deception appears in reports on weaponized PDF threats, where a familiar document becomes the first step toward malware delivery.
A link first looks at the visitor’s IP address. Visitors from other countries go to real sites like Google or YouTube, while targets get a page that quietly downloads a Base64-encoded ZIP file.
That location check reduces risk and lowers the chance that researchers get the same bad content. Inside the archive, an HTA file gets more script content and checks the device for analysis setups and allowed operating-system languages.
If the system works, it downloads a real AutoIt interpreter, a finished script, and a zipped part separately. This step-by-step method is similar to how AutoIt loader misuse is done, which helps malware hide its real goal.
The loader displays a fake Windows service window, takes the main program, and puts it into RegSvcs.exe or, if that’s not available, mobsync.exe. It also makes a Startup shortcut to stay on the system. This can trick the infected user into thinking the visible service prompt is real instead of fake.
Data Theft and Evasion
Once turned on, Casbaneiro unlocks its settings, gathers contacts, and looks at who sends and receives emails in Outlook. It sends this information without hiding it. It creates an ID from the computer name, user name, and program name, then uses a code of that ID to keep track of actions and prevent doing the same things again.
The Trojan does not use its main command channel right away. It waits until the victim goes to a targeted bank website. Then it sends system info and accepts commands to control the keyboard, paste from the clipboard, run files, and execute commands.
Organisations should see odd invoices and legal-notice PDFs as suspicious. They must check requests using a different method and stop downloaded HTA files from running if they can.
Related News:
