Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

A Brazilian banking trojan known as Ousaban is targeting Windows users in Spain and Portugal. The campaign was identified by Fortinet's FortiGuard Labs in May 2026. It begins with a phishing attack using a PDF file disguised as a corrupted file. The trojan checks the location of the target to ensure they are in either Spain or Portugal before proceeding. The malicious payload is concealed within an image file. The ultimate goal of the Ousaban trojan is to steal banking login credentials.