Ousaban: How a Brazilian Banking Trojan Keeps Adapting to Target European Bank Customers

The current Ousaban campaign targeting Santander and BBVA customers is likely to continue as long as it remains effective. Users in Spain and Portugal, particularly those with accounts at the targeted banks, should expect continued phishing attempts using deceptive PDF lures. Cybersecurity firms and financial institutions will intensify their efforts to detect and mitigate this specific variant, but the historical resilience of these trojan groups suggests a continuous cycle of adaptation and re-emergence.

Ousaban operates by tricking users into clicking on malicious links embedded within seemingly legitimate PDF documents. These PDFs often pretend to be contracts or invoices, written in Portuguese to target the specific regional demographic. Once a user clicks, a malicious downloader is activated, installing the trojan on their system.

CONFIRMED: Fortinet has confirmed Ousaban's active presence since May 2026. The trojan is capable of capturing screenshots, logging keystrokes, and stealing data from the clipboard, allowing it to harvest sensitive financial credentials and personal information. To avoid detection and analysis, Ousaban uses geofencing, meaning it only activates its full malicious payload when it detects that the infected machine is located within its target regions. It also employs steganography, a technique where malicious code is hidden within seemingly harmless image files, further complicating detection by standard antivirus software.

INFERRED: This combination of social engineering, geographic targeting, and technical evasion makes Ousaban a particularly challenging threat for both users and cybersecurity defenders. The use of a 2008-era encryption scheme and its development in Delphi, as noted by Black Duck consultant Li Zhao, suggests that while the delivery methods are refined, the core components leverage older, stable, and perhaps less scrutinized, codebases.

The persistent threat from Ousaban and its counterparts matters because it represents a continuous financial risk to individuals and a significant operational challenge for banks. For customers, a successful Ousaban infection can lead to direct financial losses, identity theft, and the psychological burden of compromised security. The targeting of major banks like Santander and BBVA, which serve millions of customers, amplifies the potential impact.

For financial institutions, these attacks demand constant investment in cybersecurity defenses, customer education, and incident response. The use of traditional tactics like fake PDFs, combined with advanced evasion techniques, means that banks cannot rely solely on technical solutions; robust user awareness campaigns are equally critical. The ability of these trojans to quickly re-emerge after takedowns also raises questions about the long-term effectiveness of law enforcement operations against such agile cybercriminal groups, implying that a more holistic, international approach is needed to disrupt their underlying infrastructure and funding.