Discover and read the best of Twitter Threads about #bankingtrojan
Most recents (1)
A modified #multibank Brazilian #bankingtrojan is actively #phishing for Mexican banking credentials using an overlay that replicates active online banking pages. Arriving as a link on #tax invoice emails, #MicrosoftDefenderATP detects this trojan as Fuery or Fuerboos. 
Interestingly, the trojan lets attackers interact with victims through the fake overlay connected to a C&C server possibly in the malware vector comprobantefiscalsatfolio[.]com.
The email link points to "folio-fiscal242211144 (1).zip", "factura folio-fiscal94077829.zip", or "SERICIOS MULTI GENERALES folio-fiscal660359864.zip", a ZIP that contains comprobantedigital39824a.exe or comprobantefiscal982sat.exe, which downloads the Trojan.
