A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot . The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci . The e-crime group was first documented by Trend Micro in October 2025. The Hacker News is the main source layer for now, and the rest should be read as a signal that is still widening. In security, the real value is not just the warning itself but the way it changes operational risk, account safety, and the cost of responding later.
Advertising slot
Patrick Tech Store Accounts, tools, and software now available in the store This slot is temporarily dedicated to the Patrick Tech ecosystem.What is happening now
A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot . The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci . The main references behind this piece include The Hacker News.
Where the sources line up
The Hacker News is the main source layer for now, and the rest should be read as a signal that is still widening. The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci . The e-crime group was first documented by Trend Micro in October 2025. A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot .
Advertising slot
Patrick Tech Store Accounts, tools, and software now available in the store This slot is temporarily dedicated to the Patrick Tech ecosystem.The details worth keeping
The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci . The e-crime group was first documented by Trend Micro in October 2025. "This threat group employs a wider-ranging attack model focused on a bespoke delivery and propagation mechanism that includes WhatsApp, ClickFix techniques, and email-centric phishing," BlueVoyant security researchers Thomas Elkins and Joshua Green said in a technical breakdown published Tuesday. In security, the real value is not just the warning itself but the way it changes operational risk, account safety, and the cost of responding later.
Why this matters most
The signal is strong enough to deserve attention, but it still needs to be read as something developing rather than fully settled. With 1 source layers on the table, the part worth reading most closely is where firm facts meet the market's early reaction. The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci .
What to watch next
The next layer to watch is scope, patch speed, and the operating cost if teams are forced to change process because of this story. Patrick Tech Media will keep checking rollout speed, user reaction, and how The Hacker News update the next pieces. In this pass, the story was distilled from 1 signals into 1 source references that are genuinely useful to readers.
Source notes
- The Hacker News pressGlobal
From Patrick Tech
Contextual tools
Secure Access Kit for Small Teams
Suggested tools for safe sign-in, account governance, and access handoff.
Open Patrick Tech StoreCommunity
What did you think of this story?
Drop a reaction or leave a comment right below the article.
Latest comments
0No comments yet. You can start the conversation.