# Scam papers served. [Research Saturday]

Page: https://stenobird.com/podcast/cyberwire-daily-454880/scam-papers-served-research-saturday
Text version: https://stenobird.com/podcast/cyberwire-daily-454880/scam-papers-served-research-saturday.md
Podcast: [CyberWire Daily](https://stenobird.com/podcast/cyberwire-daily-454880)
Published: 2026-05-16T07:00:00+00:00
Episode link: https://thecyberwire.com/podcasts/research-saturday/425/notes
Audio file: https://pdst.fm/e/pdrl.fm/85df76/traffic.megaphone.fm/CYBW9431810244.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/scam-papers-served-research-saturday
Duration seconds: 1604

## Resource

⁠⁠⁠Thomas Elkins⁠⁠⁠, SOC L3 Analyst from ⁠⁠⁠BlueVoyant⁠⁠⁠, is discussing "Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns." BlueVoyant researchers uncovered a large-scale phishing campaign by a Brazil-linked threat group targeting Spanish-speaking users across Latin America and Europe, using fake judicial summons emails, WhatsApp attacks, ClickFix tactics, and email phishing to spread the Casbaneiro banking trojan through the Horabot malware framework. The campaign uses sophisticated evasion methods including password-protected PDFs, dynamically generated ZIP filenames, anti-sandbox checks, fileless execution, and customized phishing lures to bypass security tools while turning infected systems into self-propagating botnets that hijack Outlook and webmail accounts to spread further attacks. Researchers say the operation highlights how the Augmented Marauder group (also known as Water Saci) is rapidly evolving its malware ecosystem, combining WhatsApp automation, dynamic phishing infrastructure, and advanced banking malware delivery into a highly adaptable, multi-pronged cybercrime operation. The research and executive brief can be found here: ⁠Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns⁠ Learn more about your ad choices. Visit megaphone.fm/adchoices

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cyberwire-daily-454880/episodes/scam-papers-served-research-saturday/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cyberwire-daily-454880/scam-papers-served-research-saturday.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.