Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites

Casbaneiro banking trojan campaign observed in August 2026 targeted Latin American users with phishing emails and malicious PDFs that led to geofenced pages and staged payload delivery; the malware harvests Outlook data early, only activates banking-related command-and-control when victims visit targeted financial sites, and employs sandbox/language checks, persistence via Startup shortcuts, process injection, and misleading server responses. The report includes multiple PDF and email hashes as IOCs and highlights evasion techniques (geofencing, conditional C2, malformed HTTP traffic) that complicate detection and infrastructure analysis.