Threat reportMalwareTL-2026-4859
Casbaneiro Banking Trojan Campaign Using Distributed Data-Receiving Servers Against Latin America
Casbaneiro Banking Trojan Campaign Using Distributed (TL-2026-4859), also tracked as Metamorfo, is a high-severity malware campaign, first published 2026-10-30. It has no confirmed attribution, affects Microsoft Windows, maps to 22 MITRE ATT&CK techniques (T1027, T1033, T1047), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-4859
- Threat ID
- TL-2026-4859
- Also known as
- Metamorfo
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, general-consumer
- Target regions
- argentina, peru, colombia, mexico, Latin America
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Casbaneiro Banking Trojan Campaign Using Distributed
Malware and tooling: Metamorfo, Ousaban, Rakhni, Amavaldo
How Casbaneiro Banking Trojan Campaign Using Distributed works
FortiGuard Labs reports a Casbaneiro banking trojan campaign targeting Argentina, Peru, Colombia and Mexico on Windows. Phishing PDFs lead to a geofenced ZIP download, an HTA downloader and an AutoIt loader that injects into RegSvcs.exe or mobsync.exe. Stolen data goes to multiple distributed servers, some of which deliberately return HTTP 403 to mislead analysts.
Casbaneiro (also tracked as Metamorfo) is a Latin American banking trojan first documented by ESET in 2019, which linked it to Amavaldo through a shared, uncommon cryptographic algorithm in the injector component. Fortinet FortiGuard Labs (Rachael Liao, 2026-09-10) describes a campaign with new delivery and infrastructure tradecraft. Victims receive phishing emails and PDFs themed as fake invoices and legal notices, personalized with the recipient's email address and using country-code TLDs matching the target country (Argentina, Peru, Colombia, Mexico).
The PDF link leads to a geofenced webpage. Visitors outside the target regions are redirected to Google/YouTube. Visitors in target regions receive a Base64-encoded ZIP archive embedded in JavaScript, which the script saves programmatically so the browser shows a native download notification, then redirects to a blank page. The ZIP holds an HTA file that loads external JavaScript, which retrieves an XML-based script package with embedded JScript. The HTA performs WMI-based sandbox detection and checks the OS language against a whitelist. It then downloads three separate components to C:\{random name}: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed binary with a 'crT' suffix. Fetching the components separately means no single file looks malicious on its own. Persistence is an LNK file in the Startup folder that runs the AutoIt script through the interpreter. An infection-marker folder named {ComputerName}@4{UserName} is created in %PUBLIC%.
The AutoIt loader shows a window that mimics a Windows service, then locates and decompresses the crT file and injects the Casbaneiro payload into RegSvcs.exe, falling back to mobsync.exe. The payload creates the mutex GlobolID-4465173{Username}, runs only if the system default language is not German, French or English, and builds a victim ID as the MD5 of computer name, username and executable name. It harvests email addresses from the address book and sender/recipient data from Microsoft Outlook, sends them unencrypted to an exfiltration URL, and records progress in a .Outlook file in %APPDATA%. Strings (cryptocurrency addresses, global ID, exfiltration URLs) are encrypted with the same algorithm as Ousaban. The key and ciphertext are split into fragments that are concatenated at runtime.
The campaign's notable feature is its distributed data-receiving servers. The malware sends Base64-encoded victim information to a secondary server and expects HTTP 403 Forbidden, retrying on any other status. Only after a 403 does it create two infection markers: an MD5-named folder in %TEMP% and an MD5-named registry key under HKCU\SOFTWARE. Fortinet notes this may mislead analysts into thinking the C2 is down so they overlook the real server. C2 communication starts only when the victim visits a webpage of a targeted bank. C2 tasks include keyboard control, clipboard pasting, file and command execution, and fake windows for specified banks. Observed HTTP anomalies (no Host header, unusually large Content-Length, request bodies sent in many small packets) may be intentional evasion of network inspection. Spreading stolen data across several servers at different times obscures the relationship between network connections. The report names no threat actor and no CVEs. Severity HIGH is an analyst judgment, not a vendor rating.
MITRE ATT&CK techniques used in TL-2026-4859
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1480 Execution Guardrails; T1497.001 System Checks
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1614.001 System Language Discovery
Execution
T1047 Windows Management Instrumentation; T1059.007 JavaScript; T1059.010 AutoHotKey & AutoIT; T1204.001 Malicious Link; T1204.002 Malicious File
Collection
T1056.002 GUI Input Capture; T1114.001 Local Email Collection
Command and Control
T1071.001 Web Protocols; T1132.001 Standard Encoding
defense-impairment
Persistence
T1547.009 Shortcut Modification
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Affected products and versions in Casbaneiro Banking Trojan Campaign Using Distributed
Remediation for Casbaneiro Banking Trojan Campaign Using Distributed
Immediate actions
- Block the listed domains, IPs and *.host.secureserver.net hostnames at DNS, proxy and firewall, after validating against business use
- Hunt for LNK files in Startup folders launching AutoIt (AutoIt3.exe or renamed) and for %PUBLIC%\{ComputerName}@4{UserName} folders
- Hunt for RegSvcs.exe or mobsync.exe making outbound web connections or spawned by an AutoIt interpreter
- Quarantine mail and PDFs containing links to the listed infrastructure and reset credentials of affected users
Workarounds
- Block ZIP and HTA downloads from uncategorized or newly registered domains
- Where Outlook is not required, restrict MAPI/address-book access by untrusted processes
Longer-term hardening
- Restrict mshta.exe and wscript/cscript execution of HTA/JScript from user-writable paths via application control or ASR rules
- Alert on AutoIt interpreters running from non-standard directories
- Monitor for HTTP requests lacking a Host header or with abnormal Content-Length/fragmented bodies
- Train users on invoice and legal-notice phishing lures in Spanish-speaking regions
Timeline of Casbaneiro Banking Trojan Campaign Using Distributed
- Metamorfo/Casbaneiro family active since at least April 2018 (month-level precision per MITRE ATT&CK S0455 summary)
- ESET publishes 'Casbaneiro: Trojan Dangerous Cooking', linking Casbaneiro to Amavaldo via a shared uncommon cryptographic algorithm and describing bank and crypto targeting in Brazil and Mexico
- MITRE ATT&CK creates software entry S0455 (Metamorfo), listing Casbaneiro as an alias and 'active since at least April 2018', targeting banks and crypto services in Brazil and Mexico
- The Hacker News covers Casbaneiro activity (month-level precision from article URL)
- FortiGuard Labs observes the Casbaneiro campaign against Latin America using invoice and legal-notice phishing emails and PDFs (month-level precision; Fortinet states 'In August 2026')
- Report lists FortiGuard AV detections PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr and W32/Casbaneiro.EN!tr.spy, plus IOCs (domains, IPs, hashes, two crypto wallets)
- Fortinet FortiGuard Labs publishes analysis of the campaign against Argentina, Peru, Colombia and Mexico, with geofenced ZIP delivery, HTA/AutoIt loaders, RegSvcs.exe/mobsync.exe injection and distributed HTTP 403 exfiltration servers
Sources cited for Casbaneiro Banking Trojan Campaign Using Distributed
- Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers (Fortinet FortiGuard Labs, Rachael Liao)
- Casbaneiro: Trojan Dangerous Cooking (ESET WeLiveSecurity)
- MITRE ATT&CK Software S0455: Metamorfo
- Casbaneiro Banking Malware (The Hacker News)
- Breaking Down the Casbaneiro Infection Chain - Part II (Sygnia)
- Metamorfo Banking Trojan Targets the Americas (Hive Pro)
Detection coverage for TL-2026-4859
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4859 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.