Casbaneiro Trojan Hides Banking Theft Until Victims Visit Targeted Sites

Security teams should be aware of a sophisticated banking trojan that deliberately hides its malicious activity until a victim interacts with a specific financial website. This conditional behaviour makes the malware difficult to detect through standard automated analysis tools, which often fail to trigger the malicious payload.

How does the malware evade detection?

The Casbaneiro trojan employs a conditional command-and-control activation mechanism that prevents it from communicating with its servers unless the infected user visits a targeted banking website. According to a report by GBHackers, this design choice ensures that the malware remains dormant during automated sandbox analysis, making infected systems appear inactive to security scanners.

FortiGuard Labs noted in a report shared with GBHackers that the campaign combines geographic filtering, language checks, and staged payload delivery to complicate infrastructure analysis. By separating components, the attackers make it harder for security tools to recognise the combined malicious functionality through isolated static inspection.

Who is targeted and how does infection occur?

The campaign, observed in August 2026, specifically targeted users in Latin America, including Argentina, Peru, Colombia, and Mexico. Attackers sent phishing emails containing malicious PDFs disguised as invoices or legal notices to create urgency around payments or purported legal proceedings. These documents included recipients’ email addresses to strengthen credibility.

When victims click malicious links, they are directed to geofenced webpages. Visitors outside the targeted countries are redirected to legitimate services such as Google or YouTube. For targeted users, the link retrieves an XML-based script package containing JScript, which checks for sandbox environments and identifies the operating system’s language before proceeding.

What happens once the malware is installed?

After initial checks succeed, the downloader retrieves a legitimate AutoIt interpreter, a compiled script, and a compressed payload into a randomly named directory. The AutoIt loader displays a fake Windows service window, decompresses the file, and injects Casbaneiro into RegSvcs.exe, falling back to mobsync.exe if necessary. A Startup-folder shortcut provides persistence on the system.

Casbaneiro decrypts configuration strings and rejects systems configured with German, French, or English as their default language. Before the banking-triggered communication begins, the malware collects Outlook email information, including address-book entries and sender details, transmitting this stolen data to separate endpoints without encryption.

What defensive steps should organisations take?

Security teams should monitor for unusual outbound connections from endpoints that do not match normal user behaviour, particularly those involving Base64-encoded data. Analysts should review logs for the creation of randomly named directories and the execution of legitimate tools like AutoIt in unexpected contexts.

Organisations should also inspect email attachments for malicious PDFs, especially those claiming to be urgent invoices or legal notices from unfamiliar senders. Keeping endpoint detection and response systems updated with the latest threat intelligence is crucial for identifying the specific indicators of compromise associated with this campaign.

Background: Endpoint detection and response (EDR)

Endpoint Detection and Response monitors device behaviour to spot threats that bypass traditional antivirus. It records activity, alerts on anomalies, and allows remote remediation. This approach shifts defence from known signatures to unknown tactics, reducing dwell time significantly.

Read the full guide: Endpoint Detection and Response: Answers to Ten Critical Questions

What to do and how to stay safe: Casbaneiro

• Monitor network traffic for unusual outbound connections, particularly those involving Base64-encoded data or connections to unknown endpoints that occur only when banking sites are visited.
• Inspect email attachments for malicious PDFs, especially those claiming to be urgent invoices or legal notices, and verify the sender’s identity through a separate communication channel.
• Review endpoint logs for the execution of legitimate tools like AutoIt or Windows Management Instrumentation in unexpected contexts, as well as the creation of randomly named directories.
• Ensure endpoint detection and response systems are updated with the latest threat intelligence to identify the specific indicators of compromise associated with the Casbaneiro trojan.

Step-by-step guide: Offline Backups Checklist: Verify Air-Gaps and Recovery Speed

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Casbaneiro steal banking credentials immediately upon infection?

No, the malware initiates banking-related command-and-control communication only when victims visit targeted financial websites, remaining dormant otherwise.

Which countries were targeted in this campaign?

The campaign specifically targeted users in Argentina, Peru, Colombia, and Mexico during August 2026.

How does the malware persist on an infected system?

The malware creates a shortcut in the Startup folder to ensure it runs automatically when the system boots.