{"id":234451,"date":"2026-04-02T06:24:46","date_gmt":"2026-04-02T11:24:46","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/04\/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures"},"modified":"2026-04-02T06:24:46","modified_gmt":"2026-04-02T11:24:46","slug":"casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/04\/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures","title":{"rendered":"Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures"},"content":{"rendered":"<p style=\"padding-right: 20px\"><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/casbaneiro-phishing-targets-latin-america-and-europe-using-dynamic-pdf-lures2.jpg\"><\/a><\/p>\n<p>A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like <a href=\"https:\/\/thehackernews.com\/2023\/07\/casbaneiro-banking-malware-goes-under.html\" rel=\"noopener\" target=\"_blank\">Casbaneiro<\/a> (aka Metamorfo) via another malware called <a href=\"https:\/\/thehackernews.com\/2025\/05\/horabot-malware-targets-6-latin.html\" rel=\"noopener\" target=\"_blank\">Horabot<\/a>.<\/p>\n<p>The activity has been attributed to a Brazilian cybercrime threat actor tracked as <a href=\"https:\/\/thehackernews.com\/2025\/12\/brazil-hit-by-banking-trojan-spread-via.html\" rel=\"noopener\" target=\"_blank\">Augmented Marauder and Water Saci<\/a>. The e-crime group was <a href=\"https:\/\/thehackernews.com\/2025\/11\/whatsapp-malware-maverick-hijacks.html\" rel=\"noopener\" target=\"_blank\">first documented<\/a> by Trend Micro in October 2025.<\/p>\n<p>\u201cThis threat group employs a wider-ranging attack model focused on a bespoke delivery and propagation mechanism that includes WhatsApp, <a href=\"https:\/\/thehackernews.com\/2026\/02\/microsoft-discloses-dns-based-clickfix.html\" rel=\"noopener\" target=\"_blank\">ClickFix<\/a> techniques, and email-centric phishing,\u201d BlueVoyant security researchers Thomas Elkins and Joshua Green <a href=\"https:\/\/www.bluevoyant.com\/blog\/augmented-marauders-multi-pronged-casbaneiro-campaigns\" rel=\"noopener\" target=\"_blank\">said<\/a> in a technical breakdown published Tuesday.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot. The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci. The e-crime group was first documented by Trend [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,45],"tags":[],"class_list":["post-234451","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-finance"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/234451","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=234451"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/234451\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=234451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=234451"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=234451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}