Horabot Banking Trojan Targets Mexico with Multi-Stage Phishing Campaign

• •Horabot employs a multi-stage infection chain and email worm for spreading.
• •The campaign targets users in Mexico with phishing tactics using fake CAPTCHAs.
• •Security teams are actively monitoring the resurgence of Horabot.

The Horabot banking trojan has re-emerged in Mexico, launching a sophisticated campaign that employs a multi-stage infection chain. This threat utilizes an email worm to convert infected machines into phishing relays, significantly increasing its reach. The attack combines a Delphi-based banking trojan with PowerShell scripts for propagation, leveraging fake CAPTCHA lures to deceive users. The campaign is financially motivated and targets banking credentials, affecting a wide range of users across the region. Security teams have been actively monitoring this resurgence, noting its complexity and potential for widespread impact. The current status indicates ongoing attacks, with no specific mitigation measures detailed in the articles. Organizations are urged to enhance their email security and user awareness to combat this threat.