Ousaban Trojan Uses Fake PDFs to Target Iberian Bank Users

Michael Miller · 2026-07-01

A new banking trojan named Ousaban is making waves, specifically targeting Windows users in Spain and Portugal. Discovered by Fortinet's FortiGuard Labs in May 2026, this Brazilian malware is designed to steal banking credentials from unsuspecting victims. ### How the Attack Works The attack begins with a phishing email that contains a PDF attachment disguised as a corrupted file. When the user opens it, the PDF checks their IP address to confirm they are located in either Spain or Portugal. If the location matches, the malware proceeds to the next stage. The real payload is hidden inside an image file, making it harder for antivirus software to detect. ### The End Goal: Stealing Banking Logins Ousaban's primary objective is to steal banking logins and other sensitive financial information. Once installed, it can capture keystrokes, take screenshots, and even record video from the victim's webcam. This data is then sent back to the attackers, who can use it to drain bank accounts or commit identity theft. ### Who Is at Risk? While the current campaign focuses on users in Spain and Portugal, similar tactics could easily be adapted to target other regions. Windows users who access online banking are particularly vulnerable. The malware is often distributed through phishing emails that appear to come from legitimate banks or financial institutions. ### How to Protect Yourself To stay safe from Ousaban and similar threats, follow these best practices: - Never open email attachments from unknown senders. - Verify the sender's email address before clicking on any links. - Use a reputable antivirus program and keep it updated. - Enable two-factor authentication on your banking accounts. - Consider using an antidetect browser to mask your digital fingerprint and reduce the risk of being targeted. ### The Role of Antidetect Browsers Antidetect browsers are becoming increasingly important in the fight against cyber threats. They allow users to create multiple browser profiles with different digital fingerprints, making it harder for attackers to track and target them. For professionals who manage multiple accounts or work in sensitive industries, using an antidetect browser can add an extra layer of security. ### Final Thoughts Ousaban is a reminder that cybercriminals are constantly evolving their tactics. By staying informed and taking proactive steps to protect your online activities, you can reduce your risk of falling victim to such attacks. Remember, the best defense is a combination of vigilance, updated software, and the right tools.