# Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email Spreader

> Kaspersky SOC uncovered an active Horabot campaign dubbed 'Sapecar' targeting Mexican users with a multi-stage banking Trojan and email spreader. Over 5,384 victims documented (93% in Mexico) since May 2025, using fake CAPTCHA lures, server-side polymorphic loaders, AutoIt scripts, and Delphi-based banking overlays with C2 communication via custom encrypted socket protocol.

- **Published:** 2026-03-18T12:00:00Z
- **Last reviewed:** 2026-03-18T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0244
- **ID:** TL-2026-0244
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Horabot Operators (Brazil)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Horabot 'Sapecar' campaign is an active Brazilian-origin cybercrime operation targeting Mexican financial sector users through a sophisticated multi-stage attack chain. The campaign was discovered by Kaspersky SOC during incident response and has been active since at least May 2025, with an exposed victim database revealing 5,384 compromised systems — 5,030 (93%) located in Mexico. The attack chain begins with fake CAPTCHA pages that trick users into executing mshta commands, which download an HTA file acting as a first-stage loader. This HTA opens a blank window and immediately pulls an external JavaScript payload. The second stage leverages server-side polymorphism: VBScript and JavaScript loaders are dynamically generated on the server to evade signature-based detection. The heavy lifter VBS script performs environment checks (anti-VM, anti-Avast detection) and downloads AutoIT components to C:\Users\Public\LAPTOP-0QF0NEUP4. The third stage executes an AutoIT script that decrypts a payload blob using AES-192 encryption (seed: 99521487) and loads a Delphi-compiled DLL via the exported function B080723_N. This banking Trojan — detected under various names including Casbaneiro, Ponteiro, Metamorfo, and Zusy — embeds old OpenSSL libraries (libeay32.dll, ssleay32.dll) and uses a stateful XOR-subtraction cipher with key '0xFF0wx8066h' for C2 communication. C2 configuration is retrieved via HTTPS GET to cgf.facturastbs.shop/0725/a/home with a socket fallback to lifenews.pro:49569. The custom encrypted socket protocol encapsulates data using three random 4-digit keys within '##' markers: ##[key1][key2][key3][encrypted_hex_data]##. The Trojan supports commands including PRINCIPAL, Info, SocketMain, LULUZLD, LULUZSD, and ENTERMANDA. Capabilities include SQL credential harvesting from browsers, fake banking overlay injection using RC4-encrypted resources (key: 'pega-avisao3234029284'), mouse/keyboard simulation for fraudulent transactions, keylogging, clipboard monitoring, and screen capture. The fourth stage deploys a PowerShell-based email spreader that harvests email addresses via MAPI namespace from Outlook, exfiltrates addresses to a C2 endpoint, filters against a server-side blocklist, and mass-distributes phishing emails with malicious PDF attachments from the victim's own mailbox — clearing the outbox afterward to avoid detection. This propagation mechanism makes Horabot particularly dangerous in corporate environments. Attribution points strongly to a Brazilian threat actor based on code comments in Brazilian Portuguese, cultural references in encryption keys ('pega a visao' = 'get the picture'), and ties to open-source Delphi Remote Access PC projects. The campaign infrastructure uses .buzz, .lat, .shop, .site, and .space TLDs registered through privacy-protecting registrars.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1115 Clipboard Data
- T1113 Screen Capture
- T1119 Automated Collection
- T1005 Data from Local System
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [Kaspersky SOC: Unpacking a new Horabot campaign in Mexico](https://securelist.com/horabot-campaign/119033/)
- [MITRE ATT&CK: Metamorfo (S0455)](https://attack.mitre.org/software/S0455/)
- [Cisco Talos: New Horabot campaign targets the Americas](https://blog.talosintelligence.com/new-horabot-targets-americas/)
- [Fortinet FortiGuard: Horabot Unleashed - A Stealthy Phishing Threat](https://www.fortinet.com/blog/threat-research/horabot-unleashed-a-stealthy-phishing-threat)
- [ESET: Casbaneiro - Dangerous cooking with a secret ingredient](https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/)
- [Sygnia: Breaking Down the Casbaneiro Infection Chain](https://www.sygnia.co/blog/breaking-down-casbaneiro-infection-chain/)
- [The Hacker News: Horabot Malware Targets 6 Latin American Nations](https://thehackernews.com/2025/05/horabot-malware-targets-6-latin.html)
- [Recorded Future: Brazil-based botnet targets Spanish-speakers across Americas](https://therecord.media/horabot-botnet-banking-trojan-brazil-spanish-speaking-victims)
- [ThousandGuards: Horabot - Fake invoice, real theft](https://www.thousandguards.com/post/horabot-fake-invoice-real-theft)
- [Infosecurity Magazine: Horabot Campaign Targets Spanish-Speaking Users](https://www.infosecurity-magazine.com/news/horabot-campaign-targets-spanish/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0244