Ousaban Banking Trojan Targets Spain and Portugal

FortiGuard Labs reports a May 2026 campaign distributing the Ousaban banking trojan targeting banking customers in Spain and Portugal via geo-fenced phishing PDFs and fake tax portals; the attack chain drops a VBS that retrieves a steganographic PNG to extract a ZIP and EXE, establishes persistence (Run key value "Financeiro"), and enables credential theft through keylogging, screen overlays, and clipboard injection while using dynamic C2 resolution and custom encryption.