Executive Summary
A sophisticated multi-stage campaign is currently targeting financial organizations across Latin America, specifically in Brazil. The campaign uses convincing lures, including cloned DocuSign pages and electronic tax receipts (NFe), to trick users into executing a complex infection chain. While attribution is unconfirmed, the tradecraft is currently associated with Silver Fox or Winos4.0-adjacent actors with medium confidence.
The technical workflow involves anti-bot lure pages, PowerShell downloaders hidden in .lnk files, and NSIS installers that deploy a custom HVNC (Hidden Virtual Network Computing) backdoor. This payload provides attackers with a hidden desktop environment, allowing them to bypass security controls, monitor keystrokes, and steal browser data from Firefox and potentially other browsers. The malware masquerades as 'Windows Update Assistant' to evade detection and maintain stealth.
The business impact is significant, as the HVNC functionality allows for long-term, persistent access to sensitive financial environments. This enables credential theft, session hijacking, and lateral movement within compromised networks, posing a severe risk to institutional data integrity and customer banking security.