How to uncover a Horabot campaign and detect this malware
Essential information
- Published
- 18/03/2026 11:15
- Modified
- 18/03/2026 16:52
- Tags
- 2026-03-18 autoit banking trojan brazil casbaneiro delphi email spreader horabot metamorfo mexico multi-stage attack ponteiro powershell zusy
- Related entities
- 22 observables, 1 intrusion sets (apt), 19 techniques (mitre), 5 malware, 12 others
Description
This report details the discovery and analysis of a Horabot malware campaign targeting primarily Mexican users. The attack chain begins with a fake CAPTCHA page leading to multiple stages of obfuscated scripts, ultimately delivering an AutoIT loader and a Delphi-based banking Trojan. The malware employs sophisticated encryption techniques, anti-VM checks, and a custom protocol for C2 communication. It also includes a spreader component written in PowerShell that harvests and exfiltrates email addresses to distribute phishing emails. The analysis reveals Brazilian Portuguese comments in the code, suggesting the threat actor's origin. The report provides detection opportunities including YARA rules and hunting queries to identify this threat.