Brazilian trojan Ousaban targets Santander and BBVA with evasive PDF lures
A highly evasive Brazilian banking trojan is actively targeting customers of Spain and Portugal’s largest lenders, highlighting the resilience of Latin American cybercrime networks in Europe.
Cybersecurity researchers at Fortinet have uncovered a sophisticated campaign by the Brazilian banking trojan Ousaban that is actively targeting customers of Santander, BBVA, and other major Iberian lenders. The malware uses fake PDF documents, strict geofencing, and hidden image files to steal banking credentials from Windows users in Spain and Portugal. Fortinet’s FortiGuard Labs identified the operation in May and published its analysis this week.
The attack begins with a phishing email carrying a PDF disguised as a corrupted file. The document instructs the victim to press an "Atualizar" (Update) button, which redirects them to a fraudulent tax-document portal. Hidden JavaScript within the PDF can open this malicious webpage automatically, meaning the victim does not even need to click the button to be compromised.
Before deploying its payload, the campaign thoroughly screens visitors to avoid detection by researchers and law enforcement. While an earlier version of the malware checked browser language, time zone, and VPN usage locally, the current iteration performs these checks on the server side. Anyone outside Spain or Portugal is immediately blocked with a Spanish "access denied" notice.
Users who pass the geofence download an image file designed to look like a PDF icon. This image actually contains a hidden ZIP file, a technique known as steganography. A script automatically extracts the malware from the image, executes it, and then deletes the image, the ZIP file, and itself to erase any trace of the attack.
Once installed, Ousaban creates a Windows registry entry named "Financeiro" to ensure it starts every time the computer boots. The trojan then lies dormant until the user visits one of more than two dozen targeted banks, including Santander, BBVA, CaixaBank, Bankinter, and Caixa Geral de Depositos. At that point, it captures screenshots and keystrokes, tampers with the clipboard, displays fake messages, and grants the attackers remote control of the machine.
Shutting down the operation is complicated by its infrastructure. The malware reads the current date from a Google webpage and combines it with a secret key to generate a unique web address, resolving a new command server every single day. This makes traditional blocklists ineffective, a tactic consistent with past Ousaban campaigns that hid configuration data in Google Docs.
Ousaban, also tracked as Javali, is part of a family of Brazilian banking trojans that Kaspersky dubbed the "Tetrade." These malware families—including Grandoreiro, Guildma, and Melcoz—originated in Brazil and have expanded aggressively into the Iberian Peninsula. The persistence of these groups underscores a significant ongoing threat to European retail banking security, particularly as Grandoreiro successfully resumed operations within months of an Interpol-coordinated takedown in January 2024.
For the broader European banking sector, the campaign illustrates the advanced evasion techniques now standard among cross-continental cybercrime syndicates. Fortinet notes that its antivirus products flag the samples and its FortiMail service blocks the phishing emails. For individual users and corporate security teams, the primary defence remains scrutinising any PDF claiming a file is corrupted and prompting an update, as well as avoiding prompts that ask users to paste a command to fix an error.
