Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
3 IOCs

Ousaban Banking Trojan Targets Spain and Portugal With Geofenced Phishing Campaign

Cyber Press
Cyber Press
Published July 2, 2026Original Report

Excerpt

A highly targeted phishing campaign spreading the Ousaban banking trojan to users in Spain and Portugal. Historically active in Brazil, this updated malware uses advanced geofencing, steganography, and daily-changing command-and-control domains to evade detection. The attack begins with a deceptive PDF and ultimately grants attackers full remote control over the victim’s machine, allowing them to steal sensitive financial data. Ousaban Geofenced Phishing Campaign The…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREfacture-in.pages.devfacture-arsys.duckdns…faturanova.xyzCAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(3)
Capability
Victim

Attack Flow8 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1566
1/8
Phishing
ActionDeliver phishing PDF
Victim receives a phishing PDF disguised as a corrupted file, prompting an update.

Indicators of Compromise

Open the mindmap →

3 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domainfacture-in.pages.devHighScore 58/100First seen
Domainfacture-arsys.duckdns.orgHighScore 64/100First seen
Domainfaturanova.xyzHighScore 64/100First seen

IOC Relationship Graph

Building graph…