# Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites

> A Casbaneiro banking trojan campaign observed in August 2026 targets users in Argentina, Peru, Colombia and Mexico through phishing emails with PDFs posing as invoices or legal notices. A geofenced chain (ZIP, HTA, JScript, AutoIt loader) injects the payload into RegSvcs.exe or mobsync.exe, and banking C2 activity starts only when the victim visits a targeted bank website.

- **Published:** 2026-10-12T06:27:44Z
- **Last reviewed:** 2026-10-12T11:12:15.126Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3328
- **ID:** TL-2026-3328
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiGuard Labs documented a Casbaneiro campaign observed in August 2026 and published on 2026-09-10; GBHackers re-reported it on 2026-10-12. Initial access is a phishing email or PDF disguised as an invoice or legal notice, personalized with the recipient's email address and country-code domains. The links lead to a geofenced web page: visitors outside the target regions are redirected to legitimate sites such as Google or YouTube, while eligible visitors receive a ZIP archive delivered through Base64-encoded content embedded in JavaScript.

The ZIP contains an HTA downloader that references external JavaScript. That script retrieves an XML-based script package containing JScript, which performs WMI-based environment checks (sandbox detection and OS language identification) and proceeds only if the OS language matches whitelisted countries. The loader then downloads, as separate components to hinder static detection, a legitimate AutoIt interpreter, a compiled AutoIt script and a compressed payload into a randomly named directory (C:\{random name}). The AutoIt loader displays a fake Windows service window, decompresses the payload and injects Casbaneiro into RegSvcs.exe, falling back to mobsync.exe.

The payload decrypts cryptocurrency addresses, a global ID and exfiltration URLs using fragmented decryption keys. It creates the mutex GlobolID-4465173{Username}, exits if the default system language is German, French or English, and builds an MD5 hash from the computer name, username and executable name. It harvests Outlook address-book entries and sender/recipient information and sends them unencrypted to exfiltration URLs, leaving a .Outlook marker in %APPDATA%. Victim information is sent Base64-encoded to a separate server that is expected to return HTTP 403 Forbidden; any other status causes a retry. Only after a 403 does it create an MD5-named folder in %TEMP% and an MD5-named registry key under HKCU\SOFTWARE. Persistence is an LNK file in the Startup folder that launches the AutoIt script through the interpreter, plus a {ComputerName}@4{UserName} folder in %PUBLIC% as an infection marker.

Banking C2 communication is triggered only when the victim visits a targeted financial website in a browser. Supported tasks are keyboard control, clipboard pasting, file execution, command execution and bank-themed fake windows to facilitate fraud. C2 traffic uses malformed HTTP requests (missing Host header, oversized Content-Length, payload fragmented across small packets), and the distributed servers return misleading 403 responses. The string-decryption algorithm overlaps with the Ousaban banking trojan; the source describes this as an overlap of evasion patterns, not shared operators. No threat actor is named. FortiGuard detection names: PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr and W32/Casbaneiro.EN!tr.spy.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1059.007 JavaScript
- T1059.010 AutoHotKey & AutoIT
- T1547.001 Registry Run Keys / Startup Folder
- T1218.005 Mshta
- T1055 Process Injection
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1614.001 System Language Discovery
- T1114.001 Local Email Collection
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1204.001 User Execution
- T1480 Execution Guardrails
- T1140 Deobfuscate/Decode Files or Information
- T1115 Clipboard Data
- T1105 Ingress Tool Transfer

## Sources

- [Casbaneiro: A Banking Trojan with Distributed Data Receiving Servers (FortiGuard Labs)](https://www.fortinet.com/blog/threat-research/casbaneiro-a-banking-trojan-with-distributed-data-receiving-servers/)
- [Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites (GBHackers)](https://gbhackers.com/casbaneiro-banking-trojan-2/)
- [Casbaneiro Banking Trojan Uses Distributed Data Receiving Servers (SOC Prime)](https://socprime.com/active-threats/casbaneiro-banking-trojan-uses-distributed-data-receiving-servers/)
- [Casbaneiro distributes command traffic across multiple servers (The Arabian Post)](https://thearabianpost.com/casbaneiro-distributes-command-traffic-across-multiple-servers/)
- [Casbaneiro Banking Trojan (Cyber Security News)](https://cybersecuritynews.com/casbaneiro-banking-trojan/amp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3328