Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Casbaneiro Banking Trojan Hides Its C2 Until Victims Visit Their Bank

A new Casbaneiro campaign steals Outlook data and registers victims quietly, then opens its main command channel only when the user visits a targeted bank, so infected machines can look clean.

4T4Tify Team4Tify
Oct 12, 2026·6 min read
Casbaneiro Banking Trojan Hides Its C2 Until Victims Visit Their Bank

Casbaneiro Keeps Its C2 Quiet Until the Victim Opens Their Bank

A new Casbaneiro campaign is built to look dormant. The Windows banking trojan steals data and registers the victim early, but it only opens its main command-and-control (C2) channel when the user browses to one of the banks it targets. For a defender watching network traffic, or a sandbox that never opens a banking page, an infected machine can look perfectly clean.

The activity, documented by Fortinet's FortiGuard Labs in a technical analysis published on 10 September 2026, has been aimed at users in Latin America, with Argentina, Peru, Colombia and Mexico named in the reporting.

What happened

The lure. Victims receive emails and PDF attachments dressed up as invoices or legal notices, including fake court notifications that push for an urgent response.

Geofenced delivery. The link in the document leads to a page that checks the visitor's IP address. Anyone outside the targeted country is quietly redirected to a harmless site such as Google or YouTube, which keeps researchers and scanners away from the payload. Visitors inside the target region get a Base64-encoded ZIP embedded in JavaScript, handed to the browser's normal download prompt, followed by a redirect to a blank page.

Staged loader. The ZIP holds an HTA file that pulls in external JavaScript and then an XML-wrapped JScript package. That script uses WMI to look for sandbox environments and to confirm the system language is on an allow-list. Only then does it fetch three separate pieces: a legitimate AutoIt interpreter, a compiled AutoIt script and a compressed payload, all saved under random names.

Persistence and injection. A shortcut in the Windows Startup folder relaunches the AutoIt script at every logon. The loader shows a fake Windows service progress window, then unpacks Casbaneiro and injects it into RegSvcs.exe, falling back to mobsync.exe if that binary is missing.

Split infrastructure. Data theft, victim registration and remote control each go to different servers:

  • Outlook address-book contacts and message sender/recipient details are harvested and sent unencrypted.
  • A victim ID (an MD5 of computer name, username and executable name) is sent Base64-encoded to a registration server that answers HTTP 403 Forbidden. The malware treats that 403 as success and retries on anything else.
  • The main C2 session, which supports keyboard control, clipboard pasting, file and command execution and fake banking overlays, starts only when a targeted bank site is visited.

The sample also refuses to run on systems whose default language is German, French or English, and reuses the settings-decryption algorithm seen in Ousaban. Researchers note that a shared algorithm alone does not prove both campaigns share an operator.

Why it matters

This campaign is designed to beat the shortcuts defenders rely on:

  • "No C2 traffic" does not mean "not infected." Data can leave the machine before the main control channel ever opens.
  • A 403 is not a dead server. Analysts who write off the registration host as offline infrastructure miss a working part of the chain.
  • Splitting the chain across files and servers makes each piece look benign in isolation, so per-file or per-connection analysis tends to under-score it.
  • FortiGuard also observed HTTP requests without a Host header, oversized Content-Length values and bodies trickled out in many small packets, which can trip up traffic inspection.

What to do

  1. Hunt for the AutoIt pattern. Alert on an AutoIt interpreter running from a random folder at the root of C:\, and on new .lnk files in Startup folders that launch it.
  2. Watch the injection targets. RegSvcs.exe or mobsync.exe making outbound connections, or started with no plausible parent, deserves a look.
  3. Check host artifacts: a mutex beginning GlobolID-4465173, a %PUBLIC%\{ComputerName}@4{UserName} marker folder, %APPDATA%\.Outlook, and MD5-named folders or keys under %TEMP% and HKCU\SOFTWARE. Names alone are weak signals; correlate them with suspicious behaviour.
  4. Block and search for the published network indicators, including gexwalltool[.]com, x-wolverine[.]servebbs[.]com, 72[.]167[.]48[.]63 and 209[.]99[.]188[.]28, plus the full hash and domain lists in FortiGuard's report.
  5. Tighten HTA and script execution. Where the business does not need them, block mshta.exe and treat HTA/JS attachments and downloads as high risk.
  6. Correlate email, endpoint and network telemetry so a lure, a staged download and an odd outbound request read as one incident.
  7. Brief finance and legal teams. Unexpected invoices and "court notices" that demand a fast click are the entry point here. Verify them out-of-band.
  8. Detonate with realistic behaviour. If you sandbox suspicious samples, include visits to banking sites relevant to your region; otherwise the core C2 behaviour may never show.

Indicators are defanged on purpose. Re-fang them only inside your threat intelligence platform or SIEM.

SHARE