Ousaban banking trojan spoofs PDFs to steal Spain and Portugal bank credentials
Source headline: Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures
Intelligence Summary
A Brazilian banking trojan named Ousaban is targeting Windows users who bank in Spain and Portugal. The campaign begins with a phishing document disguised as a corrupted PDF. It verifies the victim’s location and then conceals the real malicious payload inside an image. The goal is to capture banking logins and related credentials. Users should avoid opening unexpected attachments, especially PDF “corruption” lures, and ensure email and endpoint protections are up to date.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.