Episode
Scam papers served. [Research Saturday]
- Podcast
- CyberWire Daily
- Published
- May 16, 2026
- Duration seconds
- 1604
- Processing state
not_requested- Canonical source
- https://thecyberwire.com/podcasts/research-saturday/425/notes
Actions
POST https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/scam-papers-served-research-saturday/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cyberwire-daily-454880/scam-papers-served-research-saturday.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
Thomas Elkins, SOC L3 Analyst from BlueVoyant, is discussing "Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns." BlueVoyant researchers uncovered a large-scale phishing campaign by a Brazil-linked threat group targeting Spanish-speaking users across Latin America and Europe, using fake judicial summons emails, WhatsApp attacks, ClickFix tactics, and email phishing to spread the Casbaneiro banking trojan through the Horabot malware framework. The campaign uses sophisticated evasion methods including password-protected PDFs, dynamically generated ZIP filenames, anti-sandbox checks, fileless execution, and customized phishing lures to bypass security tools while turning infected systems into self-propagating botnets that hijack Outlook and webmail accounts to spread further attacks. Researchers say the operation highlights how the Augmented Marauder group (also known as Water Saci) is rapidly evolving its malware ecosystem, combining WhatsApp automation, dynamic phishing infrastructure, and advanced banking malware delivery into a highly adaptable, multi-pronged cybercrime operation. The research and executive brief can be found here: Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns Learn more about your ad choices. Visit megaphone.fm/adchoices