Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures

A multi-stage phishing campaign targets Spanish-speaking users in Latin America and Europe to deliver the Casbaneiro banking trojan via the Horabot malware.

• •The campaign is attributed to a Brazilian cybercrime group tracked as Augmented Marauder / Water Saci, first documented by Trend Micro in October 2025.
• •The attack chain begins with court summons-themed phishing emails containing password-protected PDFs, leading to ZIP downloads, HTA/VBS payloads, and AutoIt-based loaders.
• •Casbaneiro (a Delphi DLL) connects to a C2 server to fetch a PowerShell script that uses Horabot to send dynamically generated phishing PDFs to Outlook contacts.
• •The PDF generation is dynamic: a remote PHP API forges a unique, password-protected judicial summons PDF per target, making static detection difficult.