Casbaneiro Trojan Targets Latin America With Conditional C2 Activation
August 2026 campaign uses geofencing and language checks to hide banking theft until victims visit targeted financial sites, evading sandbox analysis.
Key points
- The malware activates command-and-control channels only when victims visit specific banking websites.
- Attackers used phishing emails with malicious PDFs disguised as invoices to target users in Argentina, Peru, Colombia, and Mexico.
- The trojan steals Outlook data before initiating banking-related communication, transmitting stolen information in plain text.
A Casbaneiro banking trojan campaign targeted Latin American users in August 2026, employing a conditional activation strategy to evade detection during automated security analysis. According to GBHackers, the campaign relied on phishing emails containing malicious PDFs that mimicked urgent invoices and legal notices to trick recipients into executing the malware. This approach allowed attackers to remain dormant until a specific user action triggered the next phase of the attack.
The defining characteristic of this campaign is its conditional command-and-control mechanism. The malware does not initiate communication with banking-related servers immediately after infection. Instead, it waits until the victim visits a targeted financial website before establishing the connection. This behavior makes infected systems appear inactive in sandbox environments, where automated tools typically do not simulate browsing specific banking sites. Consequently, static analysis often fails to reveal the full malicious potential of the payload.
Technical Execution and Evasion
FortiGuard Labs detailed the technical steps in a report shared with GBHackers, noting the use of geographic filtering and staged delivery to complicate infrastructure analysis. Malicious links directed victims to geofenced webpages that redirected users outside the target countries to legitimate services like Google or YouTube. For users within the targeted regions, the links delivered an XML-based script package containing JScript. This script used Windows Management Instrumentation to check for sandbox environments and verify the operating system language.
After passing these checks, the downloader retrieved a legitimate AutoIt interpreter, a compiled script, and a compressed payload into a randomly named directory. The AutoIt loader displayed a fake Windows service window while decompressing the file marked with a crT suffix. It then injected the Casbaneiro trojan into RegSvcs.exe, falling back to mobsync.exe if the primary injection target was unavailable. A shortcut in the Startup folder provided persistence, while a folder under the %PUBLIC% directory recorded the infection status.
Targeting and Data Exfiltration
The campaign specifically targeted users in Argentina, Peru, Colombia, and Mexico. The phishing documents included recipients’ actual email addresses to enhance credibility and create urgency around payments or legal proceedings. Once installed, the trojan rejected systems configured with German, French, or English as their default language. It then harvested Outlook address-book entries and email sender and recipient information.
Notably, the malware transmitted this stolen Outlook data to separate endpoints without encryption before any banking-triggered communication began. A file in the %APPDATA% folder marked the completion of this email theft. Another endpoint received Base64-encoded victim information and returned an HTTP 403 Forbidden response. Separating the components made their combined malicious functionality harder to recognize through isolated static inspection.
What should you do?
Security teams should monitor for unusual outbound traffic from systems that appear otherwise quiet, particularly connections to unknown endpoints that do not match standard banking protocols. Administrators should review logs for the execution of legitimate tools like AutoIt or Windows Management Instrumentation in unexpected contexts, as attackers often use these for payload delivery and environment checks. Endpoint detection solutions should be tuned to alert on the injection of processes into system binaries such as RegSvcs.exe or mobsync.exe, which are common persistence techniques in this type of trojan.
What to do and how to stay safe: Casbaneiro
- Monitor network logs for connections to unknown endpoints that occur only after a user visits a specific website, as this may indicate conditional malware activation.
- Inspect email attachments, particularly PDFs disguised as invoices or legal notices, in sandbox environments that simulate user interaction and browsing behavior.
- Check for the presence of legitimate interpreters like AutoIt being executed from temporary or randomly named directories, which can signal staged payload delivery.
- Review system processes for injections into system binaries such as RegSvcs.exe or mobsync.exe, which are used by this trojan for persistence and execution.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does the Casbaneiro trojan evade sandbox analysis?
It uses conditional command-and-control activation, initiating banking-related communication only when the victim visits a targeted financial website, making the system appear inactive during automated tests.
Which countries were targeted by the August 2026 Casbaneiro campaign?
The campaign specifically targeted users in Argentina, Peru, Colombia, and Mexico, using geofenced webpages to redirect non-targeted visitors to legitimate sites.
What data does the malware steal before activating its banking features?
The trojan harvests Outlook address-book entries and email sender and recipient information, transmitting this data without encryption to separate endpoints before any banking-related activity begins.
