Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its real payload inside an image. The goal is the usual one: steal banking logins and take

Fortinet reports that the Brazilian Ousaban banking trojan is running a May 2026 campaign against Windows users of banks in Spain and Portugal, using phishing PDFs that pose as corrupted files, geofenced tax-document lures, and steganography to deliver its payload.[1][9] Once installed, Ousaban quietly monitors the system and, when a targeted banking site is opened, can capture screenshots and keystrokes, tamper with the clipboard, display fake messages, and grant remote control, enabling takeover of live banking sessions across more than two dozen Iberian banks.[1] From a CyberSE.AI perspective, this illustrates a high‑risk pattern for fintech ecosystems where malware abuses sophisticated social engineering and evasion techniques that traditional email or sandbox controls may miss, requiring banks and financial platforms to continuously red‑team their user journeys, remote access workflows, and fraud detection controls against such session‑hijacking tools. Continuous AI Red Teaming can systematically simulate Ousaban‑style phishing flows and live-banking hijack scenarios to test, tune, and harden authentication, transaction verification, and anomaly‑detection mechanisms before rea