A Brazilian banking trojan called Ousaban is targeting Windows users in Spain and Portugal with a blend of social engineering and stealthy technical tricks. The campaign, documented by Fortinet’s FortiGuard Labs in May and made public this week, goes after customers of Santander and BBVA, two of the largest banks on the Iberian Peninsula.

An attack hidden inside an image

The infection chain begins with a phishing email carrying a fake PDF attachment. The file isn’t a real document; it redirects victims to a malicious site that downloads a compressed archive. Inside is an executable disguised as a harmless icon, but the real cunning lies in the final payload. The trojan conceals its malicious code inside an image using steganography, slipping past antivirus scanners. Once executed, Ousaban aims to steal banking credentials and other sensitive data, installing keyloggers and remote access modules.

Why financial services remain a prime target

Banks are high-value targets, and campaigns like this confirm that attack sophistication keeps evolving. Ousaban doesn’t spray malware indiscriminately; it uses geofencing to infect only victims in specific geographic areas. The code checks the location of the compromised machine and activates the full payload only if the IP matches a region of interest. This ploy reduces the risk of detection by sandboxes or analysis systems in other jurisdictions, prolonging the campaign’s lifespan.

From financial threats to on-premise lessons

Although the attack focuses on retail banking, the principle of geographic isolation and payload obfuscation matters to anyone running sensitive on-premise infrastructure. Organizations that host their own inference or LLM training servers locally—often for data sovereignty and GDPR compliance—face the same vector: a compromised endpoint can bypass perimeter defenses and become a springboard for lateral movement toward high-value systems. The geofencing technique is a reminder that location-based controls are not absolute protection, since an attacker with local access can launch the assault even if the territory is considered “trusted.”

Persistence and defense: an ongoing battle

Ousaban shows that banking trojans are not a relic of the past; they adapt to new evasion tools. For enterprises, the answer can’t stop at updated antivirus. Anti-phishing training, network segmentation, and behavioral monitoring are essential. In an on-premise deployment context, where the attack surface is internally managed, integrating these measures with zero-trust access policies and continuous device verification becomes critical. Only then can you reduce the chance that a fake PDF turns into a breach capable of compromising financial data—or, in broader scenarios, models and archives of a self-hosted AI infrastructure.