Back Gbhackers

Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks

Gbhackers •Mayura Kathir • March 19, 2026

Horabot has resurfaced in Mexico with a more complex, multi‑stage kill chain that blends fake CAPTCHA lures, living-off-the-land scripting, and an email worm‑style spreader to deliver a Latin American banking trojan. In this installment of the SOC Files series, our MDR team dissected a targeted Horabot campaign that we hunted a few months ago, after […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Horabot Banking Trojan Targets Mexico with Multi-Stage Phishing Campaign The Horabot banking trojan has re-emerged in Mexico, launching a sophisticated campaign that employs a multi-stage infection chain. This threat utilizes an email worm to convert infected machines into phishing relays, significantly increasing its reach. The attack combines a Delphi-based banking trojan with PowerShell scripts for propagation, leveraging fake CAPTCHA lures to deceive users. The campaign is financially motivated and targets banking credentials, affecting a wide range of users across the region. Security teams have been actively monitoring this resurgence, noting its complexity and potential for widespread impact. The current status indicates ongoing attacks, with no specific mitigation measures detailed in the articles. Organizations are urged to enhance their email security and user awareness to combat this threat. 2 sources 64

Extracted Entities

Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks

The full story

Extracted Entities

Attack Types (3)

Countries (1)

Malware (1)

MITRE ATT&CK (2)