Mispadu Trojan Targets Europe, Thousands of Credentials Compromised

**Mispadu (URSA) banking trojan campaign expanding beyond LATAM:** Research shows Mispadu — a Delphi-based info-stealer capable of credential theft, screenshots, and keystroke capture — has broadened targeting to Italy, Poland, and Sweden while still primarily impacting Mexico; the multi-stage infection chain (PDF→ZIP→MSI/HTA→VBScript→AutoIT→memory-injected payload) leverages social engineering, anti-VM checks, and historically abused a patched SmartScreen bypass (CVE-2023-36025), uses separate C2 servers for payload delivery and exfiltration, and has resulted in thousands of stolen credentials. The report also notes unrelated but concurrent stealers being distributed via YouTube video descriptions linking to password-protected archives (Lumma, Stealc, Vidar) and references other malware activity observed in the wild.