Cybercriminals Targeting Latin America with Sophisticated Phishing Scheme

A phishing and malvertising campaign focused on Latin America delivers malicious ZIP attachments that extract to HTML lures; these lever geofencing and Cloudflare Turnstile CAPTCHAs to redirect victims to RAR archives containing PowerShell scripts that fingerprint systems, check for AV, and retrieve additional malware (RATs, stealers, and miners) from cloud storage. Researchers note overlaps with prior Horabot activity and emphasize the attackers' use of geo-restricted domains, newly created infrastructure, and malvertising to evade detection.