A Brazilian banking trojan called Ousaban is targeting Windows users in Spain and Portugal. Fortinet’s FortiGuard Labs spotted the campaign in May.
It starts with a phishing PDF. The file pretends to be corrupted and asks the victim to hit an “Atualizar” (Update) button. That opens a malicious webpage. Or it just opens on its own — hidden JavaScript in the PDF handles that.
The site screens visitors. It checks IP address, language, time zone. Blocks VPNs. Blocks automated tools by looking at screen size and installed fonts. The current version moves that screening to the operator’s server, so nobody outside gets a peek at the rules. Visitors outside Spain or Portugal get a Spanish “access denied” message. No malware for you.
Pass the check, and the real payload drops. A script downloads an image that looks like a PDF icon but hides a ZIP file inside — old-school steganography. The ZIP unpacks Ousaban, the script runs it, then deletes everything to cover its tracks. Ousaban adds a registry key named “Financeiro” so it starts with Windows.
Once inside, the trojan waits. It watches for banking sites. When a target loads — names like Santander, BBVA, CaixaBank, Bankinter, Caixa Geral de Depósitos — it can capture keystrokes, grab screenshots, tamper with the clipboard, show fake messages, and hand over remote control to an attacker.
That’s a full hijacking kit.
Ousaban’s command server is hard to pin down. It reads the current date off a Google page, builds a server address from that date plus a fixed secret, and uses it. Blocking yesterday’s address does nothing. The real address moves every day.
None of this is new. Ousaban (also tracked as Javali) belongs to the “Tetrade” group alongside Grandoreiro, Guildma, and Melcoz — Brazilian banking malware families that expanded into Iberia. Grandoreiro survived an Interpol takedown in 2024 and was back within months.
What to watch for: unexpected PDFs claiming a file is corrupted and asking you to click “Update.” Prompts telling you to paste a command to fix an error (“ClickFix”). Fake invoice or tax attachments from Spanish or Portuguese senders. The campaign only hits Windows.
Defenders should look for the Financeiro registry key and files in C:\SysMain_5874288. Standard sandbox scans might miss it — the geofencing means automated fetchers get the Spanish error page, not the malware.
