As reported by The Hacker News, Fortinet's FortiGuard Labs has identified an active campaign deploying the Ousaban banking trojan against Windows users in Spain and Portugal — a notable geographic pivot for a threat actor historically rooted in Brazilian financial cybercrime.
Why This Campaign Deserves Serious Attention
Ousaban is not a new name to threat intelligence teams, but its expansion into the Iberian Peninsula signals a deliberate, strategic effort to monetize European banking credentials. Brazilian threat actors have increasingly professionalized their operations over the past several years, exporting tooling and tactics that were originally refined against Latin American banks into higher-value European markets. Spain and Portugal represent attractive targets: they share linguistic and cultural ties with Brazil, which likely reduces the effort required to craft convincing social engineering lures, and both countries have large retail banking populations with significant online and mobile banking adoption.
What makes this campaign technically notable is the combination of geo-fencing and steganography. The geo-check ensures the malware only executes against intended victims — a defensive measure for the attacker that dramatically reduces exposure to sandboxes and researchers operating outside the target region. The use of image-based payload concealment (hiding malicious code inside seemingly benign image files) is a well-established technique for evading perimeter defenses that scan for executable content but may not deeply inspect image data.
Together, these techniques create a campaign that is simultaneously targeted, evasive, and regionally disciplined — a combination that should concern security teams at financial institutions and their third-party vendors across Iberia.
Who Is Most at Risk
The Broader Threat Pattern
This campaign fits a broader trend Shield53 has been tracking: the globalization of Latin American banking trojans. Families like Grandoreiro, Mekotio, Casbaneiro, and now Ousaban have all demonstrated the capacity to retool for European targets. Europol's 2023 disruption of Grandoreiro infrastructure barely slowed the group's operators, and we expect similar resilience from Ousaban's affiliates. These are not opportunistic actors — they are organized, financially motivated, and iterative in their development cycles.
The use of phishing PDFs as an entry vector also highlights a persistent gap in organizational security posture: users remain conditioned to trust PDF attachments as inherently safer than executables, and many email gateways still apply less scrutiny to document-based lures than to direct payload delivery.
The geo-fencing and steganographic delivery combination isn't just technical sophistication for its own sake — it's a deliberate operational security choice that extends the campaign's active lifespan by minimizing early detection.
Shield53 Recommendations
For Security Teams at Financial Institutions and Enterprises
- Audit email gateway rules to ensure PDF attachments are subject to sandboxed detonation, not just static analysis. Corrupted or unusual PDF structures should trigger quarantine, not delivery.
- Implement geo-aware threat intelligence: If your user base is primarily Iberian, this campaign is live and active against your customers right now. Coordinate with your threat intel providers to obtain Ousaban IOCs from FortiGuard Labs and update detection rules immediately.
- Deploy behavioral EDR rules targeting process injection, unusual image file parsing by Office or Acrobat processes, and credential harvesting behaviors consistent with banking trojans (e.g., overlay attacks, keylogging, screenshot capture).
- Review VPN and banking portal access logs for anomalous login patterns — particularly logins from unexpected IP ranges or at unusual hours — which may indicate already-compromised credentials in active use.
- Conduct targeted user awareness training specifically covering PDF-based phishing, including examples of lures that mimic corrupted files or request users to enable content.
For End Users and Banking Customers
- Do not open PDF attachments from unexpected senders, even if the file appears to be a bank statement, invoice, or government document.
- Enable multi-factor authentication on all banking portals and financial accounts where available.
- Monitor bank accounts for unauthorized transactions and set up real-time SMS or push notification alerts.
Ousaban's arrival in Iberia is a reminder that regional threat actors don't stay regional. Security teams protecting European financial infrastructure should treat Brazilian banking trojans with the same urgency as any other advanced persistent threat — because in operational terms, that's exactly what they've become.
