Back Cybersecuritynews

Horabot Banking Trojan Resurfaces in Mexico With Multi

Cybersecuritynews •Tushar Subhra Dutta • March 19, 2026

A well-known banking trojan called Horabot has resurfaced in an active campaign targeting users across Mexico, combining a multi-stage infection chain with an email worm that turns every compromised machine into a phishing relay. The threat bundles a Delphi-based banking trojan with a PowerShell-driven spreader, making it one of the more layered financially motivated threats […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Horabot Banking Trojan Targets Mexico with Multi-Stage Phishing Campaign The Horabot banking trojan has re-emerged in Mexico, launching a sophisticated campaign that employs a multi-stage infection chain. This threat utilizes an email worm to convert infected machines into phishing relays, significantly increasing its reach. The attack combines a Delphi-based banking trojan with PowerShell scripts for propagation, leveraging fake CAPTCHA lures to deceive users. The campaign is financially motivated and targets banking credentials, affecting a wide range of users across the region. Security teams have been actively monitoring this resurgence, noting its complexity and potential for widespread impact. The current status indicates ongoing attacks, with no specific mitigation measures detailed in the articles. Organizations are urged to enhance their email security and user awareness to combat this threat. 2 sources 64

Extracted Entities

Horabot Banking Trojan Resurfaces in Mexico With Multi

The full story

Extracted Entities

Attack Types (4)

Countries (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)