{"success":true,"data":{"id":"casbaneiro-latam-court-summons-password-pdf-lure","label":"LATAM banking-trojan lure via court-summons / tax-debt narrative — Spanish or Brazilian Portuguese phrasing (\"citación judicial\", \"notificación judicial\", \"intimação judicial\", \"mandado\", \"auto de infração\") paired with a password-protected PDF/ZIP attachment (password revealed inline in the body: \"contraseña: ...\", \"senha: ...\"). Delivers Casbaneiro / Metamorfo + Horabot banking trojans targeting Santander, Banco do Brasil, Caixa, Sicredi, Bradesco, Itaú, BBVA, Banamex, Mercado Pago. Hacker News Apr 2026 + SC Media Apr 2026 + Cybereason + DarkReading + Trend Micro Water Saci / Augmented Marauder actor","description":"Email in Spanish or Brazilian Portuguese claiming a court summons, judicial notification, or tax-debt summons (\"citación judicial\", \"notificación judicial\", \"intimação judicial\", \"mandado\", \"auto de infração\", \"multa de trânsito\") with a password-protected PDF or ZIP attachment. The password is revealed in the body (\"contraseña: 1234\", \"senha: abc123\", \"clave de acceso: ...\"). The password-protected archive bypasses most mail-filter content scanners; when the victim opens it, it drops Casbaneiro (aka Metamorfo) or Horabot banking trojans. These trojans overlay fake login screens on Brazilian and Latin American bank sites (Santander, Banco do Brasil, Caixa, Sicredi, Bradesco, Itaú, BBVA, Banamex, Mercado Pago, Scotiabank) and harvest credentials + second-factor tokens. The Hacker News covered the April 2026 campaign (\"Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures\"); SC Media, Cybereason, and DarkReading all tracked the same Water Saci / Augmented Marauder actor cluster that Trend Micro flagged in October 2025; a December 2025 variant spread via WhatsApp worm + RelayNFC NFC-relay fraud. Distinct from generic password-protected attachment heuristics because the combination of LATAM-language legal phrasing + inline password reveal + PDF/ZIP attachment is uniquely diagnostic — legitimate attorneys in Spain or Brazil thread legal correspondence (In-Reply-To set) and typically do not send unsolicited password-protected PDFs with the password in the same email.","tier":"danger","category":"other","isThin":false}}