Bank Trojan 'Casbaneiro' Worms Through Latin America

Researchers attribute a regionally spreading banking malware campaign to the Brazilian group Water Saci (Augmented Marauder): attackers deliver password-protected ZIP attachments via judicial-summons-themed phishing, drop the Casbaneiro banking Trojan to capture credentials for banks and crypto platforms, and use a propagation script called Horabot to harvest victims' contacts and auto-send further phishing (also running a parallel WhatsApp campaign). The operation leverages randomized filenames and email-account compromise to bypass email security and increase trust, enabling fast worm-like spread across Latin America and Spain.