Kiran 
A fresh Casbaneiro campaign hitting Latin America has taken banking-trojan evasion to a new level, layering geofencing, staged loaders, and deliberately misleading servers to keep researchers chasing shadows.
FortiGuard Labs, which tracked the activity in August 2026, says the operators behind this Mexican banker malware family have rebuilt their delivery and command-and-control (C2) chain specifically to frustrate automated sandboxes and manual analysis alike.
The infection starts conventionally enough: phishing emails carrying PDFs disguised as invoices or legal notices, often personalized with the victim’s own email address to boost credibility.
Casbaneiro Banking Trojan Uses Geofencing
Country-code top-level domains embedded in the lures point to a tight regional focus on Argentina, Peru, Colombia, and Mexico, confirming Casbaneiro’s continued concentration on Latin American banking users.
What sets this campaign apart is a geofenced landing page. Visitors outside the targeted countries are silently redirected to Google or YouTube, while in-region victims receive a webpage that hides a Base64-encoded ZIP in its JavaScript, triggers a native-looking browser download, then dumps the user on a blank page.
Inside that ZIP is an HTA downloader that pulls an XML-wrapped JScript package, runs WMI-based sandbox checks, and proceeds only if the system’s OS language matches an approved whitelist.
Once cleared, the malware separately downloads a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed payload archive marked with a distinctive “crT” suffix, splitting the components deliberately so no single file looks malicious under static analysis.
Persistence comes via a Startup-folder LNK file, and an infection marker folder blocks reinfection. The AutoIt loader then pops a fake Windows-service window as cover while it injects the final Casbaneiro payload into RegSvcs.exe or, as a fallback, mobsync.exe.
“The most telling detail here isn’t the AutoIt injection itself it’s the 403 Forbidden trick. Any campaign that trains its own infrastructure to reject connections on purpose is signaling it was built by operators who’ve studied how analysts work, not just how banks work.”
After initialization, which includes a unique mutex, an Outlook address-book harvesting routine, and language checks that skip German, French, and English systems, Casbaneiro sends victim data to a second server that intentionally returns an HTTP 403 status.
Any other response code triggers a retry, a design choice that can trick analysts into writing off the infrastructure as dead or misconfigured, when it’s actually functioning exactly as intended.
Crucially, Casbaneiro stays dormant on the network side until the victim visits a targeted bank’s website in a browser. Only then does it fire its initial C2 packet, fragmenting exfiltrated data across separate servers so no single traffic log tells the full story.
Fortinet’s researchers also captured malformed HTTP requests missing Host headers and carrying inflated Content-Length values sent in tiny fragmented packets, likely another layer meant to trip up traffic-inspection tools.
Mitigation
FortiGuard Antivirus now flags campaign components as PDF/Phishing.5BB0!tr, JS/Phishing.IBP!tr, and W32/Casbaneiro.EN!tr.spy, with protection extended across FortiGate, FortiMail, FortiClient, and FortiEDR.
Fortinet is also pushing CDR-based document sanitization and phishing-simulation training as complementary defenses, given how heavily this campaign leans on convincing lure documents rather than technical exploits.
Indicators of compromise, including PDF and HTA hashes, C2 domains, IP addresses, and two associated cryptocurrency wallets, have been published for defenders to integrate into detection pipelines.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
