New Horabot campaign targets the Americas
Summary: Cisco Talos reported a Horabot campaign, ongoing since at least November 2020 through 2023, that uses Spanish-language income tax-themed phishing emails to target users primarily in Mexico, with additional infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. The chain runs from an HTML attachment to a PowerShell downloader hosted on an AWS EC2 instance and other servers, then sideloads a Delphi-written banking trojan and a spam tool that steals contacts' addresses and sends further phishing emails from compromised mailboxes.
Key Takeaway: The attacker's own infrastructure dates the campaign to November 2020, and the spam tool turns each infected mailbox into a launch point against the victim's contacts, so a single click can propagate the attack to your partners and customers under a trusted sender's name.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026