Metamorfo Banking Trojan Keeps Its Sights on Brazil
Summary: Cisco Talos identified two malware distribution campaigns active between late October and early November that delivered banking trojans to customers of Brazilian financial institutions, using ZIP archives named "Fatura-XXXXXXXXXX.zip" and link-shortening services to obscure distribution servers. Talos also found a C# remote administration tool on an open Amazon S3 bucket that creates BOL Online email accounts via the Recaptcha API, tied to a botnet of more than 700 compromised systems that generated over 4,000 unique emails.
What's compelling: The trojan targets customers of 14 named institutions including Santander, Itau, Banco do Brasil and Citi, and the actor built an automated email factory on 700-plus compromised machines to feed the spam that carries it.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026