Threat reportMalwareTL-2026-3328
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
Casbaneiro Banking Trojan Activates Only When Victims Visit (TL-2026-3328), also tracked as Casbaneiro, is a high-severity malware campaign, first published 2026-10-12. It has no confirmed attribution, affects Microsoft Windows (including Outlook address-book data on infected, maps to 21 MITRE ATT&CK techniques (T1027, T1047, T1048.003), and is covered by 9 detection rules and 45 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 45Indicators of compromise
Key facts for TL-2026-3328
- Threat ID
- TL-2026-3328
- Also known as
- Casbaneiro
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, general consumers
- Target regions
- argentina, peru, colombia, mexico, Latin America
- Detection rules
- 9
- Indicators of compromise
- 45
- Updates
- 2026-10-12 · revalidated 1× · latest source
Malware and tooling in Casbaneiro Banking Trojan Activates Only When Victims Visit
Malware and tooling: Metamorfo, Rakhni
How Casbaneiro Banking Trojan Activates Only When Victims Visit works
A Casbaneiro banking trojan campaign observed in August 2026 targets users in Argentina, Peru, Colombia and Mexico through phishing emails with PDFs posing as invoices or legal notices. A geofenced chain (ZIP, HTA, JScript, AutoIt loader) injects the payload into RegSvcs.exe or mobsync.exe, and banking C2 activity starts only when the victim visits a targeted bank website.
FortiGuard Labs documented a Casbaneiro campaign observed in August 2026 and published on 2026-09-10; GBHackers re-reported it on 2026-10-12. Initial access is a phishing email or PDF disguised as an invoice or legal notice, personalized with the recipient's email address and country-code domains. The links lead to a geofenced web page: visitors outside the target regions are redirected to legitimate sites such as Google or YouTube, while eligible visitors receive a ZIP archive delivered through Base64-encoded content embedded in JavaScript.
The ZIP contains an HTA downloader that references external JavaScript. That script retrieves an XML-based script package containing JScript, which performs WMI-based environment checks (sandbox detection and OS language identification) and proceeds only if the OS language matches whitelisted countries. The loader then downloads, as separate components to hinder static detection, a legitimate AutoIt interpreter, a compiled AutoIt script and a compressed payload into a randomly named directory (C:\{random name}). The AutoIt loader displays a fake Windows service window, decompresses the payload and injects Casbaneiro into RegSvcs.exe, falling back to mobsync.exe.
The payload decrypts cryptocurrency addresses, a global ID and exfiltration URLs using fragmented decryption keys. It creates the mutex GlobolID-4465173{Username}, exits if the default system language is German, French or English, and builds an MD5 hash from the computer name, username and executable name. It harvests Outlook address-book entries and sender/recipient information and sends them unencrypted to exfiltration URLs, leaving a .Outlook marker in %APPDATA%. Victim information is sent Base64-encoded to a separate server that is expected to return HTTP 403 Forbidden; any other status causes a retry. Only after a 403 does it create an MD5-named folder in %TEMP% and an MD5-named registry key under HKCU\SOFTWARE. Persistence is an LNK file in the Startup folder that launches the AutoIt script through the interpreter, plus a {ComputerName}@4{UserName} folder in %PUBLIC% as an infection marker.
Banking C2 communication is triggered only when the victim visits a targeted financial website in a browser. Supported tasks are keyboard control, clipboard pasting, file execution, command execution and bank-themed fake windows to facilitate fraud. C2 traffic uses malformed HTTP requests (missing Host header, oversized Content-Length, payload fragmented across small packets), and the distributed servers return misleading 403 responses. The string-decryption algorithm overlaps with the Ousaban banking trojan; the source describes this as an overlap of evasion patterns, not shared operators. No threat actor is named. FortiGuard detection names: PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr and W32/Casbaneiro.EN!tr.spy.
MITRE ATT&CK techniques used in TL-2026-3328
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1480 Execution Guardrails; T1497.001 System Checks
Execution
T1047 Windows Management Instrumentation; T1059.007 JavaScript; T1059.010 AutoHotKey & AutoIT; T1204.001 User Execution; T1204.002 Malicious File
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
Collection
T1114.001 Local Email Collection; T1115 Clipboard Data
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Discovery
Affected products and versions in Casbaneiro Banking Trojan Activates Only When Victims Visit
- Microsoft — Windows (including Outlook address-book data on infected hosts)
Vulnerable versions: Not specified in source
Remediation for Casbaneiro Banking Trojan Activates Only When Victims Visit
Immediate actions
- Block the listed domains, IPs and file hashes at email, proxy and endpoint layers
- Hunt for mshta.exe or wscript/cscript spawning AutoIt interpreters from randomly named directories under C:\
- Hunt for RegSvcs.exe or mobsync.exe running with AutoIt-related command lines or with unexpected network activity
- Search for the mutex GlobolID-4465173*, a .Outlook file in %APPDATA%, and {ComputerName}@4{UserName} folders in %PUBLIC%
- Review Startup-folder LNK files that launch an AutoIt interpreter and script
Workarounds
- Restrict mshta.exe execution where it is not needed for business operations
- Block execution of AutoIt interpreters from user-writable or non-standard directories
Longer-term hardening
- Use email filtering and CDR (Content Disarm and Reconstruction) to neutralize malicious PDF content
- Keep endpoint protection updated with current Casbaneiro signatures
- Monitor for unusual HTA and AutoIt execution patterns that indicate early-stage infection
- Alert on HTTP requests with a missing Host header or oversized Content-Length from endpoints
Timeline of Casbaneiro Banking Trojan Activates Only When Victims Visit
- FortiGuard Labs observed the Casbaneiro phishing campaign targeting Argentina, Peru, Colombia and Mexico (month-level date: August 2026).
- FortiGuard noted Casbaneiro uses the same string-decryption algorithm as Ousaban, with the key and encrypted strings split into fragments concatenated at runtime; described as overlapping evasion patterns, not shared operators.
- FortiGuard named detections PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr and W32/Casbaneiro.EN!tr.spy for the phishing PDFs, JS stage and Casbaneiro payload.
- The FortiGuard report released IOCs: PDF, email, HTA, AutoIt script and payload hashes, secureserver.net-hosted domains, gexwalltool.com, x-wolverine.servebbs.com, two IPs and two cryptocurrency addresses.
- FortiGuard Labs published 'Casbaneiro: A Banking Trojan with Distributed Data Receiving Servers', detailing the geofenced HTA/JScript/AutoIt chain and injection into RegSvcs.exe/mobsync.exe.
- SOC Prime published an active-threat entry with detection content for the Casbaneiro campaign (MSHTA misuse, RegSvcs/mobsync injection, HKCU\SOFTWARE MD5 keys, HTTP 403 distributed C2).
- GBHackers published coverage highlighting that C2 banking activity starts only when victims visit targeted bank websites.
Update history for TL-2026-3328
- 2026-10-12 — Casbaneiro Banking Trojan Hides C2 Activity Until Victims Visit Banking Websites: What changed No severity, exploitability, status or attribution change; additive enrichment only. New indicators (2) 2 new behavioral/file indicators: fake 'Microsoft Update Superfetch Core Endpoint Service' window and the ' crT' payload su
Sources cited for Casbaneiro Banking Trojan Activates Only When Victims Visit
- Casbaneiro: A Banking Trojan with Distributed Data Receiving Servers (FortiGuard Labs)
- Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites (GBHackers)
- Casbaneiro Banking Trojan Uses Distributed Data Receiving Servers (SOC Prime)
- Casbaneiro distributes command traffic across multiple servers (The Arabian Post)
- Casbaneiro Banking Trojan (Cyber Security News)
Detection coverage for TL-2026-3328
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3328 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.