Hackers Use Geofenced Webpages to Deliver Ousaban Banking Trojan in Spain and Portugal

A targeted phishing campaign is distributing the Ousaban banking Trojan to users in Spain and Portugal via a malicious PDF that leads to a geofenced webpage; the actor uses server-side environment checks, steganographic images with appended ZIPs, a VBS downloader, and DLL side-loading to deliver a feature-rich banking Trojan that supports keylogging, remote control, and adaptive C2 resolution. The report includes multiple IOCs (domains, IPs, PDF SHA256s), details on persistence (Run key Financeiro, C:\SysMain_* staging), and recommendations to monitor these artifacts.