Horabot Malware Campaigns Escalate Across Latin America with Weaponized HTML Tactics
A new malware operation is gaining traction in Latin America, specifically targeting Spanish-speaking users with highly tailored phishing attacks. This campaign centers around Horabot, a sophisticated malware strain delivered through deceptive HTML files.
Discovered by Fortinet’s FortiGuard Labs in April 2025, Horabot exhibits a hybrid threat model. It blends banking Trojan behavior with credential harvesting and automated email propagation, enabling it to infiltrate both enterprise environments and individual users.
The threat actors behind this campaign exploit trust by mimicking legitimate financial communications. Victims typically receive ZIP file attachments masquerading as genuine invoices—commonly under the subject line “Factura Adjunta.” Inside is a poisoned HTML file that initiates a carefully staged infection process.
Once opened, the HTML file decodes an embedded Base64 string that points to a masked malicious domain (e.g., hxxps://t4.contactswebaccion.store/0704/). This leads to a secondary stage hosted on a JavaScript-based landing page, which quietly triggers a chain of downloads involving VBScript and PowerShell components—each crafted to slip past basic security filters and deliver the final Horabot payload.
This campaign reflects an ongoing evolution in phishing methods, emphasizing localization, scripting obfuscation, and HTML abuse as core strategies.
Inside Horabot’s Multi-Stage Infection Strategy and Stealth Arsenal
Security analysts have uncovered new layers of complexity in the Horabot malware campaign, highlighting a deeply obfuscated infection chain originating from the domain t4[.]contactswebaccion[.]store (as reported by Fortinet).
At the core of this operation is a JavaScript file that silently triggers the retrieval of a second ZIP package—ADJUNTOS_23042025.zip. Packed within is a concealed HTA (HTML Application) file engineered to bypass user suspicion and traditional detection tools.
Once embedded in the system, Horabot exploits Microsoft Outlook’s COM automation features, effectively taking control of the victim’s inbox. From there, it self-replicates by crafting and sending phishing emails to the user’s contact list, enabling rapid lateral spread across networks.
What makes Horabot especially elusive is its use of native Windows scripting environments to cloak its movements. By integrating AutoIt and PowerShell for decrypting and executing payloads, the malware blends seamlessly with normal system activity, making anomalies harder to spot in behavioral analytics.
A custom-crafted VBScript acts as the control node, orchestrating these stages with precision while helping the malware evade endpoint detection systems. This strategic layering of stealth and automation underscores Horabot’s rising threat profile in the region.
Horabot’s Cloaked Code: Obfuscation, Evasion, and Persistence Tactics Uncovered
Investigators analyzing the domain dl[.]webcorreio[.]pics (source: Fortinet) have identified a heavily obfuscated VBScript acting as a key component in Horabot’s infection framework.
Rather than relying on static strings, the malware applies algorithmic transformations to reconstruct critical data in memory, including command-and-control (C2) endpoints and PowerShell execution logic. A custom routine—detRBFJ_11—decodes these strings by manipulating character pairs, subtracting ASCII values, and assembling the decrypted instructions at runtime.
This design frustrates traditional signature-based detection, allowing Horabot to slip past many static analysis engines with ease.
Adding another layer of defense, Horabot includes advanced sandbox evasion. Before executing its core functions, the malware interrogates the host environment for virtualization clues. Using Windows Management Instrumentation (WMI), it checks BIOS and hardware model identifiers for known sandbox indicators like “VMware,” “Hyper-V,” and “VirtualBox.” If such artifacts are present, the script aborts, leaving no trace.
Similarly, it conducts an antivirus presence check, terminating execution if it detects the Avast installation directory at C:\Program Files\Avast Software.
To maintain long-term access, Horabot leverages multiple persistence mechanisms. It creates hidden directories under C:\Users\Public\LAPTOPOQFONEUP, sets file attributes to system-protected states, and uses PowerShell-based scheduled tasks to reinitiate its payload after reboot.
In a more unconventional move, the malware deploys an AutoIt script disguised as a GIF file—winupdate_version_758.gif—which it compiles into an .a3x executable. This compiled binary then decrypts and activates a concealed payload (winupdate_version_535.ia), completing the infection chain.
Horabot’s strategy showcases a deep understanding of Windows internals, paired with a layered evasion model that challenges conventional security defenses at every step.
Deceptive Overlays: Horabot’s Credential Theft in Action
In its final act, Horabot executes a targeted credential-harvesting maneuver by deploying a banking Trojan that superimposes counterfeit login screens over real financial websites. These deceptive overlays are virtually indistinguishable from authentic interfaces, luring users into unknowingly handing over sensitive banking credentials.
This technique underscores a broader trend in 2025: the convergence of advanced social engineering with deeply embedded malware tactics. Rather than relying solely on code, Horabot exploits human trust—presenting polished, fake pop-up windows at just the right moment to maximize the chance of interaction.
The campaign reflects a growing evolution in phishing operations, where visual deception and backend obfuscation work hand in hand to bypass both user intuition and security defenses.
Trusted Tools, Hidden Threats: Horabot’s Abuse of Native Utilities
Horabot’s infection chain demonstrates how legitimate Windows components—such as Outlook and PowerShell—can be weaponized to carry out malicious operations without triggering immediate red flags. By embedding itself within these trusted environments, the malware evades many traditional detection methods, highlighting the critical gap in reactive defenses.
While Fortinet’s threat intelligence systems already recognize and neutralize known indicators—such as HTML/Phishing.683A!tr and AutoIt/Agent.HA!tr—the evolving nature of this malware calls for more than just signature-based protection.
To stay ahead of such threats, organizations must adopt behavior-based detection, enhance visibility into script execution, and invest in ongoing user awareness training. Attackers continue to exploit the human element and overlooked system behaviors, making proactive defense and early anomaly detection essential.
