{"id":214064,"date":"2025-05-15T01:15:50","date_gmt":"2025-05-15T06:15:50","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2025\/05\/horabot-malware-targets-6-latin-american-nations-using-invoice-themed-phishing-emails"},"modified":"2025-05-15T01:15:50","modified_gmt":"2025-05-15T06:15:50","slug":"horabot-malware-targets-6-latin-american-nations-using-invoice-themed-phishing-emails","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2025\/05\/horabot-malware-targets-6-latin-american-nations-using-invoice-themed-phishing-emails","title":{"rendered":"Horabot Malware Targets 6 Latin American Nations Using Invoice-Themed Phishing Emails"},"content":{"rendered":"<p style=\"padding-right: 20px\"><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/horabot-malware-targets-6-latin-american-nations-using-invoice-themed-phishing-emails2.jpg\"><\/a><\/p>\n<p>Then last year, Trustwave SpiderLabs <a href=\"https:\/\/thehackernews.com\/2024\/04\/cybercriminals-targeting-latin-america.html\" rel=\"noopener\" target=\"_blank\">revealed<\/a> details of another phishing campaign targeting the same region with malicious payloads which it said exhibits similarities with that of Horabot malware.<\/p>\n<p>The latest set of attacks starts with a phishing email that employs invoice-themed lures to entice users into opening a ZIP archive containing a PDF document. However, in reality, the attached ZIP file contains a malicious HTML file with Base64-encoded HTML data that\u2019s designed to reach out to a remote server and download the next-stage payload.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Then last year, Trustwave SpiderLabs revealed details of another phishing campaign targeting the same region with malicious payloads which it said exhibits similarities with that of Horabot malware. The latest set of attacks starts with a phishing email that employs invoice-themed lures to entice users into opening a ZIP archive containing a PDF document. However, [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-214064","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/214064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=214064"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/214064\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=214064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=214064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=214064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}