InfoSecBulletin Cybersecurity for mankind
Casbaneiro is going after online banking users by sending fake messages that seem like urgent bills or legal papers. The campaign uses custom PDF tricks to lead people to a harmful download, risking email information, bank activity, and system details.
The Windows-based operation stays quiet until it really needs to act. Once it gets in, it waits for someone to visit a specific bank website, then it connects to its control system and can start actions meant to help with fraud.
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Fortinet researchers found the activity in August 2026 and followed victims in Argentina, Peru, Colombia, and Mexico. The results show that regional filtering, staged downloads, and timed network traffic can make a banking Trojan tougher to detect during normal security checks.
Fortinet said in a report the campaign sends stolen data to different servers and uses a fake HTTP 403 response to mislead analysis. The approach creates a risk beyond one compromised account, because harvested contacts and email details can support later attacks.
Hackers Deploy Casbaneiro Banking Trojan
The attack starts with an email and a PDF that make the recipient feel rushed about a bill or a fake legal case. The documents might show the recipient’s email address, which is a trick to make it seem more real.
Similar deception appears in reports on weaponized PDF threats, where a familiar document becomes the first step toward malware delivery.
A link first looks at the visitor’s IP address. Visitors from other countries go to real sites like Google or YouTube, while targets get a page that quietly downloads a Base64-encoded ZIP file.
That location check reduces risk and lowers the chance that researchers get the same bad content. Inside the archive, an HTA file gets more script content and checks the device for analysis setups and allowed operating-system languages.
If the system works, it downloads a real AutoIt interpreter, a finished script, and a zipped part separately. This step-by-step method is similar to how AutoIt loader misuse is done, which helps malware hide its real goal.
The loader displays a fake Windows service window, takes the main program, and puts it into RegSvcs.exe or, if that’s not available, mobsync.exe. It also makes a Startup shortcut to stay on the system. This can trick the infected user into thinking the visible service prompt is real instead of fake.
Data Theft and Evasion
Once turned on, Casbaneiro unlocks its settings, gathers contacts, and looks at who sends and receives emails in Outlook. It sends this information without hiding it. It creates an ID from the computer name, user name, and program name, then uses a code of that ID to keep track of actions and prevent doing the same things again.
The Trojan does not use its main command channel right away. It waits until the victim goes to a targeted bank website. Then it sends system info and accepts commands to control the keyboard, paste from the clipboard, run files, and execute commands.
Organisations should see odd invoices and legal-notice PDFs as suspicious. They must check requests using a different method and stop downloaded HTA files from running if they can.
Related News:
