A sophisticated cyber campaign is targeting online banking users in Spain and Portugal, initiated by seemingly innocuous PDFs. The malware, named Ousaban, is specifically crafted to compromise customers of Iberian financial institutions using Windows systems.
Phishing PDFs Conceal Malicious Intent
The attack commences when potential victims interact with a phishing PDF that appears corrupted. Encouraged to click an ‘Atualizar’ or Update button, users unknowingly access a malicious website disguised as a government tax portal. This site subsequently verifies whether the user’s location is within Spain or Portugal before proceeding with the attack.
Fortinet’s FortiGuard Labs identified this wave of Ousaban activity in May 2026, publishing a comprehensive analysis of its mechanisms. Their report, shared with Cyber Security News, highlights the campaign’s use of geofencing, obfuscated payloads, and dynamic infrastructure to evade detection.
Steganography and Evasion Tactics
Once a target’s location is confirmed, a script downloads an image file masquerading as a PDF icon. Within this image lies a ZIP archive containing the Ousaban payload, a method known as steganography. The malware then erases its installation traces to hinder detection efforts.
Ousaban is part of a notorious group of Brazilian banking trojans, often associated with Grandoreiro, Guildma, and Melcoz under the ‘Tetrade’ moniker. Recent developments in its deployment strategy, including a specialized delivery mechanism, aim to remain undetected by researchers and automated scanning systems outside Spain and Portugal.
Credential Theft and Defense Strategies
Upon installation, Ousaban remains inactive until the victim accesses one of over two dozen targeted banking sites, such as Santander and BBVA. It can then capture screenshots, log keystrokes, and create counterfeit banking screens to extract login credentials.
The malware’s command infrastructure employs a deceptive Pastebin link that misleads analysts. The actual command and control domain changes daily, using a hash derived from Google’s error page, complicating efforts to block access.
Fortinet advises vigilance against suspicious file prompts, particularly those claiming corruption and urging updates. Security teams should scrutinize unexpected document attachments, especially within organizations connected to Spain and Portugal.
The Fortinet antivirus and email security solutions already identify and flag threats linked to this campaign, emphasizing the importance of correlating various logs instead of relying solely on automated sandbox results.
By understanding Ousaban’s tactics, security professionals can better protect their organizations and users from this persistent threat.
