Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users

A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity.

The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files.

The campaign demonstrates how Latin American banking malware operators are evolving beyond conventional credential theft.

Casbaneiro combines localized social-engineering lures, environment-aware malware staging, process injection, fake banking windows, and conditional C2 activation to reduce visibility across endpoint and network defenses.

The accompanying PDFs include malicious links and, in several cases, embed the recipient’s email address to make the content appear tailored and credible.

Victims who click the link are first evaluated by a geofenced landing page. Requests from IP addresses outside the targeted countries are redirected to benign destinations such as Google or YouTube.

Users located in the intended region instead receive a ZIP archive whose Base64-encoded contents are embedded in JavaScript.

The script triggers the download through the browser before redirecting the victim to a blank page, helping the activity resemble a standard document download.

The archive contains an HTA downloader that retrieves external JavaScript and an XML-based script package.

This stage uses Windows Management Instrumentation to inspect the victim environment, including sandbox-related conditions and operating-system language.

FortiGuard Labs Researchers said that, the attack begins with phishing emails that use urgency-driven themes such as unpaid invoices, legal proceedings, and official notices.

Casbaneiro Banking Trojan

Execution continues only when the host language matches the campaign’s predefined targeting criteria.

After passing the environment checks, the downloader retrieves three separate components into a randomly named directory under C:: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed payload file with a .crT suffix.

The malware also creates a host-specific directory in %PUBLIC%, using a format based on the computer and user names, to mark an already infected machine and avoid repeated execution.

On launch, the AutoIt component displays a fake Windows service window, decompresses the final Casbaneiro payload, and injects it into RegSvcs.exe. If that process is unavailable, it falls back to mobsync.exe.

Casbaneiro decrypts configuration values at runtime, including cryptocurrency addresses, a global identifier, and data-exfiltration URLs.

FortiGuard noted that its string decryption approach resembles the method used by the Ousaban malware family, suggesting code or tradecraft overlap among regional financial-threat operations.

The Trojan collects email addresses from the victim’s address book and extracts sender-recipient information from Microsoft Outlook messages.

It then sends the data, unencrypted, to a designated exfiltration endpoint. A separate server receives Base64-encoded victim information but deliberately responds with HTTP 403 Forbidden; Casbaneiro retries the request when it receives any other response.

That behavior is particularly significant for defenders. A 403 response would commonly be interpreted as failed access or inactive infrastructure, yet in this campaign it serves as an expected signal in the malware’s workflow.

Casbaneiro creates local filesystem and registry markers only after receiving that response, reducing duplicate traffic and limiting observable artifacts.

The actual C2 channel is not activated immediately after infection. Instead, Casbaneiro waits until the victim visits a targeted banking website through a browser.

Only then does it transmit an initial C2 packet and receive instructions associated with bank-focused fraud.

Supported commands include keyboard control, clipboard manipulation, file execution, command execution, and operations connected to fake windows used to impersonate banking interfaces.

These capabilities align with Casbaneiro’s established use of overlay-style fraud and clipboard replacement, where attackers can alter copied payment details or trick victims into entering credentials into attacker-controlled windows.

By separating stolen data across several servers and initiating traffic at different phases of infection, the operators make correlation harder for analysts reviewing proxy, DNS, firewall, and endpoint telemetry.

Researchers also captured malformed HTTP requests lacking a Host header and carrying unusually large Content-Length values, while the payload was fragmented across many smaller packets an additional tactic that may hinder network inspection.

FortiGuard detects the campaign components as PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr, and W32/Casbaneiro.EN!tr.spy.

Organizations with users or customers in Latin America should prioritize phishing filtering, monitor for HTA and AutoIt execution, investigate unexpected Startup-folder LNK files, and alert on browser-triggered connections to suspicious infrastructure following visits to financial websites.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.