Spy Banker Trojan Telax Abusing Google Cloud Servers

Zscaler ThreatLabZ describes an active Spy Banker (Telax) campaign targeting Portuguese-speaking users in Brazil that uses social-engineering lures (coupon offers, fake apps) and shortened bit.ly links redirecting to Google Cloud-hosted payloads; the initial downloader retrieves a Delphi Telax payload which injects into vbc.exe, registers rootkit drivers, harvests banking credentials (including bypassing 2FA via fake panels), and communicates with C2 servers. The report provides filenames, domains, WHOIS data, distribution statistics, detailed module analysis, C2 commands, and numerous file hashes, and notes that Zscaler protections cover the observed samples.