Scam papers served.

About this episode

Thomas Elkins discusses a large-scale phishing campaign by a Brazil-linked threat group targeting Spanish-speaking users.

⁠⁠Thomas Elkins⁠⁠, SOC L3 Analyst from ⁠⁠BlueVoyant⁠⁠, is discussing "Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns." BlueVoyant researchers uncovered a large-scale phishing campaign by a Brazil-linked threat group targeting Spanish-speaking users across Latin America and Europe, using fake judicial summons emails, WhatsApp attacks, ClickFix tactics, and email phishing to spread the Casbaneiro banking trojan through the Horabot malware framework. The campaign uses sophisticated evasion methods including password-protected PDFs, dynamically generated ZIP filenames, anti-sandbox checks, fileless execution, and customized phishing lures to bypass security tools while turning infected systems into self-propagating botnets that hijack Outlook and webmail accounts to spread further attacks. Researchers say the operation highlights how the Augmented Marauder group (also known as Water Saci) is rapidly evolving its malware ecosystem, combining WhatsApp automation, dynamic phishing infrastructure, and advanced banking malware delivery into a highly adaptable, multi-pronged cybercrime operation. The research and executive brief can be found here: ⁠Unpacking Augmented…

People in this episode

Guest: Thomas Elkins

Topics covered

• phishing campaigns
• cybersecurity
• malware
• banking trojans
• threat intelligence
• cybercrime

Keywords

• phishing
• cybersecurity
• malware
• banking trojan
• Augmented Marauder
• BlueVoyant
• Horabot

Mentioned in this episode

Organizations: BlueVoyant, Augmented Marauder, Water Saci

Products: Casbaneiro banking trojan, Horabot malware framework

Places: Latin America, Europe

More episodes of Research Saturday

• The skills pay the bills. · May 30, 2026 · 24 min
• Ghosted by Grafana · May 23, 2026 · 26 min
• The spy who logged me in. · May 9, 2026 · 24 min
• Double-edged threat. · May 2, 2026 · 31 min
• A QRazy clever scam. · April 25, 2026 · 19 min
• A new breed of RAT. · April 18, 2026 · 22 min