Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email Spreader
Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico (TL-2026-0244), also tracked as Operation Sapecar, is a high-severity malware campaign, first published 2026-03-18. It is attributed to Horabot Operators (Brazil) with high confidence, affects Microsoft Windows, maps to 34 MITRE ATT&CK techniques (T1005, T1010, T1027), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0244
- Threat ID
- TL-2026-0244
- Also known as
- Operation Sapecar, Horabot Mexico Campaign 2025
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-03-18
- Last reviewed
- 2026-03-18
- Attribution
- Horabot Operators
- Attribution confidence
- HIGH
- Nation-state nexus
- Brazil
- Motivation
- FINANCIAL
- Target sectors
- financial, banking, government, healthcare, education, retail, manufacturing
- Target regions
- Mexico, Latin America, Guatemala, Colombia, Peru, Chile, Argentina
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
Malware and tooling: Horabot, Metamorfo, AutoIT
Kaspersky SOC uncovered an active Horabot campaign dubbed 'Sapecar' targeting Mexican users with a multi-stage banking Trojan and email spreader. Over 5,384 victims documented (93% in Mexico) since May 2025, using fake CAPTCHA lures, server-side polymorphic loaders, AutoIt scripts, and Delphi-based banking overlays with C2 communication via custom encrypted socket protocol.
How Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico works
The Horabot 'Sapecar' campaign is an active Brazilian-origin cybercrime operation targeting Mexican financial sector users through a sophisticated multi-stage attack chain. The campaign was discovered by Kaspersky SOC during incident response and has been active since at least May 2025, with an exposed victim database revealing 5,384 compromised systems — 5,030 (93%) located in Mexico. The attack chain begins with fake CAPTCHA pages that trick users into executing mshta commands, which download an HTA file acting as a first-stage loader. This HTA opens a blank window and immediately pulls an external JavaScript payload. The second stage leverages server-side polymorphism: VBScript and JavaScript loaders are dynamically generated on the server to evade signature-based detection. The heavy lifter VBS script performs environment checks (anti-VM, anti-Avast detection) and downloads AutoIT components to C:\Users\Public\LAPTOP-0QF0NEUP4. The third stage executes an AutoIT script that decrypts a payload blob using AES-192 encryption (seed: 99521487) and loads a Delphi-compiled DLL via the exported function B080723_N. This banking Trojan — detected under various names including Casbaneiro, Ponteiro, Metamorfo, and Zusy — embeds old OpenSSL libraries (libeay32.dll, ssleay32.dll) and uses a stateful XOR-subtraction cipher with key '0xFF0wx8066h' for C2 communication. C2 configuration is retrieved via HTTPS GET to cgf.facturastbs.shop/0725/a/home with a socket fallback to lifenews.pro:49569. The custom encrypted socket protocol encapsulates data using three random 4-digit keys within '##' markers: ##[key1][key2][key3][encrypted_hex_data]##. The Trojan supports commands including PRINCIPAL, Info, SocketMain, LULUZLD, LULUZSD, and ENTERMANDA. Capabilities include SQL credential harvesting from browsers, fake banking overlay injection using RC4-encrypted resources (key: 'pega-avisao3234029284'), mouse/keyboard simulation for fraudulent transactions, keylogging, clipboard monitoring, and screen capture. The fourth stage deploys a PowerShell-based email spreader that harvests email addresses via MAPI namespace from Outlook, exfiltrates addresses to a C2 endpoint, filters against a server-side blocklist, and mass-distributes phishing emails with malicious PDF attachments from the victim's own mailbox — clearing the outbox afterward to avoid detection. This propagation mechanism makes Horabot particularly dangerous in corporate environments. Attribution points strongly to a Brazilian threat actor based on code comments in Brazilian Portuguese, cultural references in encryption keys ('pega a visao' = 'get the picture'), and ties to open-source Delphi Remote Access PC projects. The campaign infrastructure uses .buzz, .lat, .shop, .site, and .space TLDs registered through privacy-protecting registrars.
MITRE ATT&CK techniques used in TL-2026-0244
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data; T1119 Automated Collection
discovery
T1010 Application Window Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel
stealth
T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow
persistence
T1547 Boot or Logon Autostart Execution
credential-access
T1555 Credentials from Password Stores
impact
initial-access
defense-impairment
Affected products and versions in Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Microsoft — Outlook
Vulnerable versions: 2016; 2019; 2021; 365 - Multiple — Web Browsers (Chrome, Firefox, Edge)
Vulnerable versions: All versions with saved credentials - Multiple — Mexican Banking Portals
Vulnerable versions: Online banking platforms targeted by overlay injection
Remediation for Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
Immediate actions
- Block all identified C2 domains and IPs at perimeter firewalls and DNS sinkholes
- Block mshta.exe execution via AppLocker or WDAC policies where not required
- Search for persistence LNK files in user Startup folders
- Scan endpoints for AutoIT components in C:\Users\Public\ directories
- Monitor for anomalous Outlook COM automation and mass email sending
- Block outbound connections to non-standard ports, especially port 49569
Workarounds
- Disable mshta.exe via Group Policy if not required for business operations
- Block AutoIT execution on endpoints without legitimate business need
- Restrict Outlook COM automation access via registry policies
- Implement browser credential storage alternatives (enterprise password managers)
Longer-term hardening
- Deploy EDR with behavioral detection for DLL sideloading and AutoIT abuse
- Implement email authentication (DMARC/DKIM/SPF) to limit spoofed distribution
- Enable multi-factor authentication on all banking and financial portals
- Restrict PowerShell execution policy and enable script block logging
- Deploy network detection for custom socket protocol patterns
- Implement application whitelisting to prevent unauthorized script interpreters
Weaknesses (CWE) in Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
CWE-494, CWE-319, CWE-522
Timeline of Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
- Casbaneiro/Metamorfo banking Trojan family first emerges targeting Latin American financial sector in mass email spam campaigns
- Horabot botnet first observed delivering Casbaneiro banking Trojan and spam tools to victims in the Americas
- Cisco Talos publishes report on Horabot campaign targeting Spanish-speaking users across the Americas
- Earliest victim entries in exposed database indicate Sapecar campaign begins targeting Mexican users
- FortiGuard Labs publishes analysis of Horabot as stealthy phishing threat targeting six Latin American nations
- Exposed victim database at pdj.gruposhac.lat shows 5,384 victims with 93% (5,030) in Mexico, including geographic coordinates
- Kaspersky SOC begins DFIR investigation into Horabot Sapecar campaign during incident response engagement
- Full infrastructure mapping reveals C2 domains across .buzz, .lat, .shop, .site, and .space TLDs with server-side polymorphic loader capabilities
- Detection artifacts including YARA rules for AutoIT loader and Delphi DLL, and Suricata rule for C2 socket protocol pattern published
- Kaspersky publishes full technical analysis 'The SOC Files: Time to Sapecar' on Securelist with complete IOCs and detection rules
- As of 2026-05-29, the Horabot 'Sapecar' banking trojan campaign remains ACTIVE: no CVE, no takedown or arrests reported, and the Brazilian operators (Augmented Marauder/Water Saci) keep running it. April 2026 BlueVoyant/THN reporting shows the same Horabot/Casbaneiro actors expanding from LatAm into Europe with new dynamic-PDF and ClickFix lures.
Sources cited for Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
- Kaspersky SOC: Unpacking a new Horabot campaign in Mexico
- MITRE ATT&CK: Metamorfo (S0455)
- Cisco Talos: New Horabot campaign targets the Americas
- Fortinet FortiGuard: Horabot Unleashed - A Stealthy Phishing Threat
- ESET: Casbaneiro - Dangerous cooking with a secret ingredient
- Sygnia: Breaking Down the Casbaneiro Infection Chain
- The Hacker News: Horabot Malware Targets 6 Latin American Nations
- Recorded Future: Brazil-based botnet targets Spanish-speakers across Americas
- ThousandGuards: Horabot - Fake invoice, real theft
- Infosecurity Magazine: Horabot Campaign Targets Spanish-Speaking Users
Threats related to Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico
- MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
- DarkCloud Infostealer — Commercial VB6 Credential-Harvesting Malware (A310Logger/BluStealer Successor)
- SnappyClient C2 Framework — New Implant Delivered via HijackLoader and ClickFix
- Operation DragonReturn — China-Nexus DcRAT Multi-Stage Espionage Campaign Targeting Govt. of India Ministry of Finance / Income Tax Infrastructure
- TCLBANKER Brazilian Banking Trojan — Trojanized Logi AI Prompt Builder DLL Sideload with WhatsApp and Outlook Worm Modules (REF3076)
- The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm
Detection coverage for TL-2026-0244
As of 2026-03-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0244 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.