Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks

Horabot has resurfaced in Mexico with a more complex, multi‑stage kill chain that blends fake CAPTCHA lures, living-off-the-land scripting, and an email worm‑style spreader to deliver a Latin American banking trojan.

In this installment of the SOC Files series, our MDR team dissected a targeted Horabot campaign that we hunted a few months ago, after an endpoint alert flagged suspicious MSHTA activity in a customer environment.

Follow‑up threat hunting and infrastructure pivoting revealed that this was part of an active Horabot operation combining a Delphi banking trojan, an email spreader, and multiple layers of obfuscated scripts.

An exposed attacker‑controlled webpage displayed a victim panel with 5,384 entries, with roughly 93% of compromised hosts located in Mexico, underscoring the geographic focus of this wave.

Kaspersky Endpoint Security blocked the execution early, terminating the malicious process and removing related files before the threat could fully execute.

Linguistic artefacts in scripts and spreader comments, written in Brazilian Portuguese, point to operators with Brazilian roots but a clear focus on Spanish‑speaking targets in Latin America.

Multi‑stage phishing chain

The infection starts with a fake CAPTCHA page hosted on attacker infrastructure that instructs victims to open the Run dialog and execute a supplied mshta command pointing to a remote HTA file.

In the incident mentioned above, this page was located at the URL https://evs.grupotuis[.]buzz/0capcha17/

That HTA behaves as a small loader, displaying a blank window while pulling external JavaScript that dynamically injects a VBScript reference into the page header.

The VBScript layer is served with server‑side polymorphism, meaning each request returns a slightly altered but functionally equivalent script, complicating static detection.​

Subsequent VBScript stages become increasingly complex, implementing heavy obfuscation, custom string decoders, anti‑VM checks, basic anti‑Avast logic, host profiling, and data exfiltration to a command‑and‑control server.

This “heavy lifter” script downloads an AutoIt executable, its compiler, an obfuscated AutoIt script and an encrypted blob, sets persistence via a Startup LNK file, and cleans up temporary artefacts to reduce forensic visibility.

A more readable version with its strings decoded and replaced using a small Python script that replicates the decode_str() routine.

The exposed victim panel, populated by this stage, confirms continuous activity since at least May 2025, with thousands of infected systems.

On disk, the AutoIt components decrypt the blob using AES‑192 with a hard‑coded seed‑derived key and map the result directly into memory as a DLL, avoiding straightforward on‑disk signatures.

Analysis shows this DLL is a well‑known Delphi banking trojan from the Casbaneiro/Metamorfo/Zusy family, previously linked to campaigns against banking users in Brazil and Mexico.

It embeds OpenSSL libraries from the Indy project to establish HTTPS‑based C2, and it includes SQL logic to harvest credentials from browsers and other local stores.

The trojan retrieves its configuration from hard‑coded URLs, parsing encrypted values that define C2 socket endpoints, trigger strings, and PowerShell commands.

It uses a custom stateful XOR‑subtraction cipher for string and config decryption, plus another XOR‑based scheme for socket traffic wrapped in distinctive “##key1key2key3cipher##” frames, which can be turned into high‑fidelity IDS signatures.

Borrowed protocol logic from an open‑source Delphi RAT underpins its socket layer, extended with bespoke commands to manipulate the keyboard, mouse, and on‑screen overlays that impersonate banking interfaces.

Email worm spreader

Beyond credential theft, Horabot stands out for its email worm‑like spreader written in PowerShell and orchestrated through staged downloaders.

The most important routine is responsible for decrypting the blob file (it uses AES-192 with a key derived from the seed value 99521487), loading it directly into memory, and then calling the exported function B080723_N. 

Once activated, the spreader abuses Outlook/MAPI automation to harvest email addresses, exfiltrate unique contacts to the C2, clear the outbox, and then send Spanish‑language phishing messages with malicious attachments at scale.

These emails typically masquerade as invoices or confidential financial documents and direct victims to HTML or PDF content that restarts the same fake CAPTCHA and scripting chain.

Comments embedded in the PowerShell spreader, written in informal Brazilian Portuguese, reveal the operators’ mindset and even inspired this article’s title, emphasising a “blast it off” approach to mass mailing.

Earlier reporting also shows that Horabot relies on malicious HTML attachments and invoice‑themed lures to penetrate organisations, then uses victims’ own inboxes to propagate laterally, blurring the line between phishing and worm behaviour.

Defenders can anchor detection at multiple layers: mshta launching remote HTA content via Run dialog, chained JavaScript VBScript execution from unusual domains, AutoIt plus AES‑192 in small loaders, and Delphi DLLs with the Casbaneiro‑style export pattern.

Network monitoring should watch for Horabot’s characteristic HTTPS endpoints and the irregular “##[digits][hex]##” socket frames, which stand out sharply against legitimate web traffic and are suitable for IDS rules.

On the email side, organisations in Mexico and wider Latin America should pay special attention to invoice‑themed HTML/PDF attachments, especially where Outlook automation and sudden spikes in outbound mail suggest an internal account has been hijacked.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.