Brazilian Banking Trojan Ousaban Targets Spain and Portugal

Fortinet's FortiGuard Labs reports that Ousaban, a banking trojan from the Latin American family related to Casbaneiro, has been active since May 2026 against targets in Spain and Portugal. The campaign uses phishing PDFs that lead to a geofenced server-side profiling step (language, timezone, IP, VPN/sandbox checks), then delivers a steganography-concealed payload; once installed it performs keylogging, screenshots, clipboard injection and remote control to capture bank credentials for fraud, using a rotating domain mechanism and other evasion techniques.