Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal

Key facts for Recorteiro banking trojan

Detection coverage for Recorteiro banking trojan

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5535 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Recorteiro Delivery Chain - curl.exe Download Followed By PowerShell ExecutionPolicy Bypass

Correlates, per host and 15-minute window, a curl.exe download of a script or file with a PowerShell ExecutionPolicy Bypass launch by cmd.exe or curl.exe. This is the Recorteiro (win.recorteiro, TL-2026-5535) fake EnergiaLusa electricity bill chain: batch file, curl.exe download, PowerShell dropper, loader.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.003, T1059.001, T1105
• Data sources: sysmon (Event ID 1), index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval proc=lower(Image), parent=lower(ParentImage), cmd=lower(CommandLine)
| eval curl_dl=if(match(proc,"curl\.exe$") AND match(cmd,"https?://") AND match(cmd,"(\.ps1|\.bat|\.cmd|-o\s|--output)"),1,0)
| eval ps_bypass=if(match(proc,"(powershell|pwsh)\.exe$") AND match(cmd,"-e[a-z]*\s+bypass") AND match(parent,"(cmd|curl)\.exe$"),1,0)
| where curl_dl=1 OR ps_bypass=1
| bin _time span=15m
| stats sum(curl_dl) as curl_downloads sum(ps_bypass) as ps_bypass_runs values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User _time
| where curl_downloads>=1 AND ps_bypass_runs>=1
| table _time host User curl_downloads ps_bypass_runs command_lines parent_command_lines

Microsoft KQL

let lookback = 24h;
let curl_dl = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName =~ "curl.exe"
| where ProcessCommandLine matches regex @"(?i)https?://"
| where ProcessCommandLine matches regex @"(?i)(\.ps1|\.bat|\.cmd|\s-o\s|--output)"
| project DeviceId, DeviceName, AccountName, CurlTime = Timestamp, CurlCmd = ProcessCommandLine, CurlParentCmd = InitiatingProcessCommandLine;
let ps_bypass = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)-e[a-z]*\s+bypass"
| where InitiatingProcessFileName in~ ("cmd.exe", "curl.exe")
| project DeviceId, PsTime = Timestamp, PsCmd = ProcessCommandLine;
curl_dl
| join kind=inner ps_bypass on DeviceId
| where PsTime between (CurlTime .. (CurlTime + 15m))
| project DeviceName, AccountName, CurlTime, CurlCmd, CurlParentCmd, PsTime, PsCmd
| order by CurlTime desc

Sigma

title: Recorteiro - PowerShell ExecutionPolicy Bypass Launched From Batch File
id: 3f6b1c52-8a47-4d19-9e0b-5c2a7d41e601
status: experimental
description: Detects PowerShell started with -ExecutionPolicy Bypass by cmd.exe running a .bat/.cmd file, the Recorteiro (win.recorteiro) delivery chain where a minimized batch stage runs a curl.exe-downloaded PowerShell dropper (TL-2026-5535).
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.recorteiro
    - https://seguranca-informatica.pt/recorteiro-a-rust-banking-trojan-that-cuts-holes-in-your-screen-and-hides-behind-fake-electricity-bills-in-portugal/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_bypass:
        CommandLine|contains:
            - '-ExecutionPolicy Bypass'
            - '-ep Bypass'
            - '-Exec Bypass'
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains:
            - '.bat'
            - '.cmd'
    condition: all of selection_*
falsepositives:
    - Legitimate software deployment or logon scripts that wrap PowerShell in a batch file
    - IT automation and installers that run PowerShell with a Bypass policy
level: high

Known false positives:

• Admin or deployment scripts that download with curl.exe and run PowerShell with Bypass
• Developer bootstrap scripts

Tuning notes: Exclude known admin hosts, service accounts and trusted software distribution URLs; widen the span if download and execution are separated by more than 15 minutes. Source details are single-source, so review hits manually.

• 🔒 Recorteiro Stage 1 - Batch File Using curl.exe To Download PowerShell Stage · unlock with TL Creds
• 🔒 Recorteiro Persistence - Chrome Or Edge ExtensionInstallForcelist Modified · unlock with TL Creds
• 🔒 Recorteiro C2 - Non-Browser Process Contacting Supabase Or [indicator] · unlock with TL Creds
• 🔒 Recorteiro Dropper - PowerShell ExecutionPolicy Bypass Downloading Loader · unlock with TL Creds
• 🔒 Recorteiro Persistence - Scheduled Task Or Service Created For User-Writable Binary · unlock with TL Creds
• 🔒 Recorteiro C2 - User-Writable Process Resolving Supabase Or Fallback Domain · unlock with TL Creds
• 🔒 Recorteiro Persistence - Run Key, Scheduled Task Or Service From User-Writable Path · unlock with TL Creds
• 🔒 Recorteiro C2 - [indicator] Fallback Domain Resolution Or Connection · unlock with TL Creds

Indicators of compromise for Recorteiro banking trojan

As of 2026-11-09, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5535.

Sample indicators (1 of 12)

• Domain: windowshelpers[.]com

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

How Recorteiro banking trojan works

Recorteiro was documented on 2026-11-05 by Pedro Tavares (Seguranca Informatica) and added to the Malpedia library as family win.recorteiro. The original article could not be retrieved during research (HTTP 403 from the publisher). The technical details below come from a secondary summary of that article published by CISOCLUB (itself sourced via CTT Report Hub) and have not been cross-checked against the primary report. Treat them as single-source.

Lure and delivery: the campaign uses fake electricity bills that impersonate a company named EnergiaLusa. According to the secondary summary, the delivery chain starts with a batch file run in a minimized window that sends a campaign beacon. The batch file uses curl.exe to download a PowerShell stage, which is run with the execution policy bypassed. The PowerShell dropper then downloads and runs a loader. The dropper checks for recently created or modified installation folders. The initial delivery vector (for example email attachment or link) is not stated in the accessible sources.

Persistence and loader: persistence is reported through a randomly named HKCU Run value, a scheduled task, and a Windows service. The loader supervises the main process, accepts digitally signed updates, and can roll back a build that crashes. It downloads an encrypted core of about 23 MB from the C2. Loader code is identical across samples, and file hashes differ because of added decoy files and per-build data.

Core implant: the Rust core is decrypted and written with a per-victim hash, and its configuration and strings are encrypted or obfuscated. At start-up it retrieves the current C2 address from Supabase, with windowshelpers.com as the fallback. C2 traffic runs over a TLS WebSocket. The core reports host information, installed security products, screen state and loader state. It inventories security tooling but does not try to disable it or kill its processes. It also sends analysis-environment signals to the operator, who decides whether to pause or block the agent.

Fraud and theft capabilities: target lists include Portuguese banks (Millennium bcp, Novo Banco, Santander, BPI), and the operator is notified when a target window and process match. The implant steals browser passwords, cookies, saved card data, history and localStorage from multiple browsers, and targets cryptocurrency wallets. To bypass Chrome App-Bound Encryption it runs code inside the browser process. A force-installed Chrome/Edge extension provides browser-level control and access to bank session data. Further capabilities are screenshots, H.264 video streaming over WebRTC, and remote keyboard and mouse control. The 'Recort' fraud mode shows a full-screen overlay with a hole through which the real bank page area is visible. The victim's input is confined to that area while the operator can type. Separate tooling supports affiliate-tagged loader delivery and campaign management.

Attribution: sources point to a Portugal-focused campaign with possible Brazilian links, but the operators have not been identified. No Malpedia actor is linked to the family. Malpedia has no description, YARA or aliases for the family yet. No file hashes, IPs or full domain lists were available in accessible sources, so the IOC set is limited to the indicators evidenced above.

MITRE ATT&CK techniques by tactic:

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1219 Remote Access Tools; T1573 Encrypted Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Persistence

T1053.005 Scheduled Task; T1176 Software Extensions; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

Collection

T1113 Screen Capture

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Remediation for Recorteiro banking trojan

Immediate actions

• Block windowshelpers.com at DNS and proxy and alert on any resolution of it
• Hunt for batch files launching curl.exe followed by powershell.exe with -ExecutionPolicy Bypass from user-writable paths
• Review HKCU Run values, scheduled tasks and newly created services created shortly after such activity
• Audit Chrome and Edge for force-installed or unknown extensions (ExtensionInstallForcelist policy and extension directories)
• Warn Portuguese users and staff about fake EnergiaLusa electricity bills

Workarounds

• Banks and users: treat any request to enter banking data into a partially visible or overlaid page as fraud and end the session
• Reset browser-stored credentials and invalidate banking sessions for any host with a confirmed infection

Longer-term hardening

• Restrict curl.exe and PowerShell execution by non-administrative users with application control or constrained language mode
• Alert on outbound WebSocket and WebRTC traffic from non-browser processes
• Block or monitor Supabase endpoints that are not business-approved
• Use EDR with detection of code injection into browser processes (Chrome App-Bound Encryption bypass)
• Enforce an allowlist of browser extensions on managed endpoints

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints (specific versions not reported)
• Google / Microsoft — Chrome and Edge browsers (credential, cookie and session theft; forced extension)
  Vulnerable versions: Versions not reported

Timeline of Recorteiro banking trojan

• 2026-11-05 Malpedia family page win.locked-ioc-6 shows its only reference as this article, with no description, aliases, YARA or actors.
• 2026-11-05 Malpedia adds the article to its library and links it to the family win.locked-ioc-6.
• 2026-11-05 Pedro Tavares (Seguranca Informatica) publishes the locked-ioc-6 analysis: a Rust banking trojan using fake electricity bills in Portugal. This is the earliest public disclosure found.
• 2026-11-06 CISOCLUB publishes a Russian-language summary, sourced via CTT Report Hub, with the delivery chain, loader/core behavior, C2 design and fraud capabilities. The page does not state the year; 2026 is inferred from the source article date.
• 2026-11-08 This Week in 4n6 (week 45, 2026) lists the locked-ioc-6 article in its threat intelligence section.
• 2026-11-09 Re-check of the Malpedia family page win.locked-ioc-6 during research: the only reference is still the 2026-11-05 article, with no description, aliases, YARA rules or linked actors. The original article remains unretrievable (HTTP 403) and no additional corroborating coverage was found.

Sources cited for Recorteiro banking trojan

• Recorteiro: a Rust banking trojan that cuts holes in your screen and hides behind fake electricity bills in Portugal (Malpedia library entry) malpedia.caad.fkie.fraunhofer.de · Research · 2026-11-05
• Malpedia family entry win.recorteiro malpedia.caad.fkie.fraunhofer.de · Research · 2026-11-05
• Recorteiro: a Rust banking trojan that cuts holes in your screen and hides behind fake electricity bills in Portugal (Seguranca Informatica, Pedro Tavares; original article, not retrievable: HTTP 403) seguranca-informatica.pt · Blog · 2026-11-05
• CISOCLUB: Campaign in Portugal spreads the Recorteiro banking trojan for Windows (Russian-language summary; source of technical details) cisoclub.ru · News · 2026-11-06
• This Week in 4n6: Week 45 2026 (threat intelligence roundup listing Recorteiro) thisweekin4n6.com · News · 2026-11-08

More in malware

• SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)
• NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control
• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982