New banking trojan “Carnaval Heist” targets Brazil with overlay attacks
Summary: Cisco Talos reports that CarnavalHeist, a banking trojan it assesses with high confidence to be of Brazilian origin, has been active since early February 2024 and targets prominent Brazilian financial institutions through financially themed emails with fake invoices, IS.GD URL shorteners, and WebDAV-delivered LNK or MSI files that install Python and inject a Delphi-based payload into mshta.exe. The malware uses overlay windows to capture credentials, supports roughly 80 unencrypted C2 commands including keyboard capture, screenshots, video capture and AnyDesk remote control, and can generate QR codes on demand to redirect bank transactions.
What's compelling: Talos tied the campaign to two actors at high confidence through a WHOIS record exposing a Brazilian CPF national ID and a registrant with criminal records in the Brazilian judiciary system - and the malware's C2 commands travel unencrypted over TCP, meaning the operators' tradecraft is exposed even as their overlays sit on top of your customers' banking sessions.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026