MEDIUMMalware
Global

Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

·Source: The Hacker News

Updated:

Executive Summary

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its real payload inside an image. The goal is the usual one: steal banking logins and take

Analysis

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its real payload inside an image. The goal is the usual one: steal banking logins and take
Source Attribution

Originally published by The Hacker News on Jul 1, 2026.

Related Threats

MEDIUMMalware

VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEIL#DROP by Securonix. It's suspected that the initial payloads are distributed either via spear-phishing or a drive-by compromise, which occurs when an unsuspecting user lands on

The Hacker News
MEDIUMMalware

Fileless Malware Abuses Google Blogspot to Deploy Infostealer in Memory

Securonix said the Veil#Drop campaign abuses Google Blogspot to deliver PureLog Stealer in memory

Infosecurity Magazine
MEDIUMMalware

Brazilian Banking Trojan Ousaban Targets Spain and Portugal

FortiGuard says the Brazilian banking trojan Ousaban is targeting Spain and Portugal via phishing

Infosecurity Magazine