Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

Summary: Fortinet's FortiGuard Labs identified a campaign in May 2026 in which the Brazilian banking trojan Ousaban targets Windows users in Spain and Portugal through phishing PDFs disguised as corrupted files that prompt an "Atualizar" button and screen visitors by IP address, language, and time zone. Ousaban monitors more than two dozen banks including Banco Santander, BBVA, CaixaBank, Bankinter, and Caixa Geral de Depósitos, capturing screenshots and keystrokes, tampering with the clipboard, and giving the attacker remote control of live banking sessions.
Bottom line: The command server address changes daily, built from the current date read off a Google page plus a fixed secret, so blocking yesterday's address does little good. Server-side screening means an automated sandbox that fetches the link may receive only a Spanish access-denied page instead of the malware, and gateway detonation alone can miss it.

Read the original at The Hacker News ↗