New Horabot Campaign Targets Victims in Mexico with Banking Trojan

Kaspersky has uncovered a targeted Horabot campaign primarily affecting victims in Mexico, with 93% of the 5,384 recorded victims located there. The attack employs a fake CAPTCHA page that instructs users to execute a malicious command, initiating a complex infection chain. This malware combines a banking trojan and an email spreader, utilizing tools like PowerShell and VBScript for its operations. The Horabot malware collects sensitive information, including IP addresses and banking credentials, and spreads through phishing emails with malicious attachments. Despite being known for several years, Horabot remains active and continues to evolve, necessitating updated security measures. Kaspersky emphasizes the importance of human-led detection and robust security operations to mitigate such threats.

Key Points: • Horabot campaign targets over 5,000 victims, primarily in Mexico. • Attack method involves fake CAPTCHA pages and execution of malicious commands. • Malware combines banking trojan and email spreader, utilizing PowerShell and VBScript.