Operation Comando: How to Run a Cheap and Effective Credit Card Business
Summary: Palo Alto Networks Unit 42 identified a campaign active since August 2018 that targets Brazilian victims, mainly in the hospitality sector, through travel-themed emails carrying malicious documents that use MSHTA to fetch remote scripts. The researchers traced the actor's infrastructure to a custom .NET information-stealing trojan they named CapturaTela, which screenshots browser windows matching specific title strings and emails the images as JPEG attachments, alongside commodity RATs including LimeRAT, RevengeRAT, NjRAT, AsyncRAT, NanoCoreRAT and RemcosRAT.
Why it matters: The actor ran this campaign on free dynamic DNS accounts, open-source RATs from GitHub and basic VB.NET knowledge, yet the custom trojan was built specifically to capture full credit card details during hotel booking purchases - a reminder that a low-budget operation can persist for months against reservation systems holding payment data.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026