Executive Summary
FortiGuard Labs identified a campaign in May 2026 involving the Ousaban banking trojan, specifically targeting users in Spain and Portugal. The attack chain begins with phishing PDFs that lead victims to a geofenced landing page. This page performs sophisticated server-side and client-side checks to verify the victim's location and identify automated analysis environments before delivering the final payload.
Technically, Ousaban leverages VBS scripts to download steganographic images containing ZIP archives, which house the primary executable. The malware exhibits features common to Latin American banking trojans, including custom XOR-based encryption and daily-changing C2 hostnames derived from MD5 hashes of the current date. It primarily seeks to capture banking credentials and provide remote control over infected Windows systems.
This campaign demonstrates high operational security through the use of server-side geofencing and decoys, such as Pastebin posts containing private IP addresses. The targeting of specific financial institutions in the Iberian Peninsula highlights a focused effort to bypass regional security controls and maximize the impact of credential theft.