Threat reportMalwareTL-2026-4462
Ousaban Banking Trojan Campaign Targeting Banking Users in Spain and Portugal
Ousaban Banking Trojan Campaign Targeting Banking Users in (TL-2026-4462), also tracked as Javali, is a high-severity malware campaign, first published 2026-10-26. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1027.003, T1036.008, T1056.001), and is covered by 9 detection rules and 33 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 33Indicators of compromise
Key facts for TL-2026-4462
- Threat ID
- TL-2026-4462
- Also known as
- Javali, Ousaban
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, consumer
- Target regions
- spain, portugal, Europe
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in Ousaban Banking Trojan Campaign Targeting Banking Users in
Malware and tooling: Grandoreiro - S0531, Javali - S0528, Metamorfo, Ousaban, RemoteControl
How Ousaban Banking Trojan Campaign Targeting Banking Users in works
FortiGuard Labs analyzes an ongoing Ousaban (Javali) banking Trojan campaign against users in Spain and Portugal. Phishing PDFs lead to geofenced malicious pages, VBS downloaders fetch steganographic images with an embedded ZIP payload, and C2 uses daily-rotating DDNS subdomains.
Ousaban (also tracked as Javali) is a Brazilian-origin banking Trojan belonging to the Latin American family cluster that Kaspersky labeled the 'Tetrade' (Grandoreiro, Guildma, Melcoz, Javali/Ousaban). FortiGuard Labs identified an ongoing campaign in May 2026 and published its analysis on 2026-07-01, describing attacks on banking users in Spain and Portugal. Targeted institutions reported by press coverage of the research include Banco Santander, BBVA, CaixaBank, Bankinter and Caixa Geral de Depositos; the target-bank list is stored encrypted inside the payload.
The infection chain begins with a phishing PDF disguised as a corrupted file with an 'Atualizar' (Update) button; the PDF embeds hex-escaped JavaScript. The button directs the victim to a malicious webpage that performs geofencing and environment checks: IP/device verification of language, timezone and location, blocking of VPNs (keyword 'vpn' in organization info), screen resolution, browser rendering and font enumeration, and blocking of sandboxes and crawlers. Newer variants move the validation server-side to hide the criteria; when checks fail the page randomly (about 50%) shows an error or serves a file download. Passing victims receive a VBS downloader containing benign filler function calls, which fetches an image resembling a PDF icon that steganographically embeds a ZIP archive. The script extracts the ZIP to C:\SysMain_5874288, executes the Ousaban payload, and deletes the image, ZIP and VBS files to reduce forensic footprint.
The payload persists through a registry value named 'Financeiro' under CurrentVersion\Run and uses a marker file maisum.dat whose creation time serves as the install timestamp. Strings and network traffic are protected by a custom encryption algorithm (random first-byte base offset, subsequent bytes XORed with a key with the offset subtracted, adding 0xFF on underflow) shared with other Latin American banking Trojans such as Casbaneiro. A Pastebin-hosted configuration decrypts to a private IP address and acts as a decoy. The real C2 is resolved through daily-changing DDNS hostnames built as 'aki' plus the first 8 characters of an MD5 of a hard-coded string concatenated with the current date; the date is obtained by deliberately visiting the Google automated-queries page. The C2 command set includes #Convite# (collect user information), #Handle# (assign victim ID), #ON-LINE# (heartbeat), #xyScree# (screen resolution request) and #Iniciar# (screenshot capture, remote control, keylogging, clipboard injection).
Fortinet also describes an earlier (late 2025) variant with two entry points: a ClickFix lure leading to a VBS and then an MSI installer, and a PDF lure leading to a phishing page and an MSI installer, where the MSI is a Rust-based downloader that executes the Ousaban payload. Earlier campaigns stored configuration in Google Docs. No CVE is involved and no threat actor beyond the malware family is attributed in the sources. A BeaconBeagle lookup for 213.159.64.191 returned no record (HTTP 404). Fortinet detection names: W32/Ousaban.EY!tr.spy, VBS/Agent.TPX!tr.dldr, PDF/Agent.STG!tr.
MITRE ATT&CK techniques used in TL-2026-4462
Defense Evasion
T1027.003 Steganography; T1036.008 Masquerade File Type; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497.001 System Checks
Credential Access
Execution
T1059.005 Visual Basic; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071 Application Layer Protocol; T1568.002 Domain Generation Algorithms; T1573.001 Symmetric Cryptography
Collection
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in Ousaban Banking Trojan Campaign Targeting Banking Users in
- Microsoft — Windows
Vulnerable versions: Windows endpoints used for online banking
Remediation for Ousaban Banking Trojan Campaign Targeting Banking Users in
Immediate actions
- Block the listed domains and IP addresses at DNS, proxy and firewall
- Hunt for the 'Financeiro' Run key, maisum.dat and C:\SysMain_5874288 on Windows endpoints
- Alert on wscript.exe/cscript.exe launching VBS that downloads image files and extracts archives
- Block or monitor *.duckdns.org lookups of the form aki<8 hex chars> from user endpoints
Workarounds
- Disable Windows Script Host where not required
- Open PDFs from untrusted email only in a sandboxed or browser-based viewer
Longer-term hardening
- Deploy EDR with behavioral detection for script-based downloaders and Run-key persistence
- Restrict .vbs execution via application control (WDAC/AppLocker) or default file association changes
- Train banking and finance users to treat 'corrupted PDF / Update' prompts as phishing
- Filter dynamic-DNS providers where there is no business need
Timeline of Ousaban Banking Trojan Campaign Targeting Banking Users in
- Earlier Ousaban variant active in late 2025 (exact day not stated in source; month approximate), using ClickFix to VBS to MSI and PDF to phishing page to MSI delivery, with a Rust-based MSI downloader
- VBS downloader fetches a PDF-icon image with embedded ZIP, unpacks to C:\SysMain_5874288, runs Ousaban and deletes image, ZIP and VBS (observed in May 2026 campaign; day not stated)
- Newer variants in the May 2026 campaign move geofencing/VPN/environment validation server-side; failed checks return an access-denied PDF or a random error/download
- FortiGuard Labs identifies the ongoing Ousaban campaign targeting Spain and Portugal (May 2026; day not stated)
- Intelliway publishes analysis of the Ousaban steganography case referencing Fortinet's findings and the Iberian targeting
- The Hacker News and The Next Web report on the campaign, naming Santander, BBVA, CaixaBank, Bankinter and Caixa Geral de Depositos among targets
- Fortinet releases IOCs: 5 domains, 4 IPs and SHA256 hashes for PDF, HTML, VBS, MSI and EXE stages
- FortiGuard Labs publishes 'Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula' (author Rachael Liao) with IOCs and detection names W32/Ousaban.EY!tr.spy, VBS/Agent.TPX!tr.dldr, PDF/Agent.STG!tr
Sources cited for Ousaban Banking Trojan Campaign Targeting Banking Users in
- Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula (FortiGuard Labs)
- Ousaban Banking Trojan Targets Iberian Banking Users (The Hacker News)
- Ousaban banking trojan Spain Portugal fake PDF (The Next Web)
- Banking Malware with Steganography: What the Ousaban Case Teaches Brazil (Intelliway)
- Brazilian Banking Trojan Ousaban Crosses the Atlantic With PDF Tricks and Hidden Payloads (WebProNews)
- Ousaban widens banking threat across Iberia (The Arabian Post)
- Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula (OffSeq Radar)
Detection coverage for TL-2026-4462
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4462 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4462
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.