Ousaban Banking Trojan Targets Bank Customers in Spain and Portugal

A new attack by the Ousaban Banking Trojan specifically targets Windows users conducting banking transactions in Spain and Portugal. Security researchers from Fortinet's FortiGuard Labs discovered the campaign in May 2026. The malware employs a sophisticated method to deceive unsuspecting users and steal their banking information. The attack begins with a phishing PDF disguised as a corrupted file, designed to pique users' curiosity and prompt them to open it.

Once the file is opened, the malware checks whether the user is indeed from Spain or Portugal to specifically target the right victims. A key feature of the Ousaban Trojan is how it conceals its payload. The malware embeds its malicious code within an image displayed in the PDF file. This technique makes detection by conventional security software more difficult, as the harmful content is not immediately visible. The primary targets of the Ousaban Trojan are users' banking login credentials.

Once the malware is successfully installed on the victim's system, it can intercept user inputs and transmit them to the attackers. This enables the perpetrators to gain unauthorized access to bank accounts and carry out financial transactions. FortiGuard Labs warns that the spread of the Ousaban Trojan has increased in recent weeks. Security researchers recommend exercising particular caution with email attachments and ensuring that the security software in use is always up to date. Users should also be wary of suspicious links or files.

The malware also employs geolocation techniques to ensure that only users from the target regions are attacked. This targeted approach significantly increases the success rate of the attacks, as the malware is only disseminated to relevant users. In addition to the technical aspects of the attack, it is crucial for users to be aware of the risks associated with phishing attacks. Using strong passwords and enabling two-factor authentication can help enhance account security and reduce the risk of a successful attack. The security situation in Spain and Portugal remains tense, as more and more online banking users are affected.

Authorities and banks are working to educate the public about the dangers of malware and phishing attacks. Comprehensive user awareness is essential to minimize the impact of such attacks. The discovery of the Ousaban Banking Trojan highlights the ongoing threat of cybercrime in Europe. Fortinet's security researchers have already taken measures to contain the spread of the malware and warn affected users. The exact number of impacted users is currently unknown; however, the number of attacks is expected to rise in the coming weeks.

Fortinet has classified the vulnerability exploited by the Ousaban Trojan as critical. Users are urged to regularly check their systems for malware and report any suspicious activities immediately. The vulnerability could potentially endanger thousands of users. Security researchers recommend deleting all suspicious emails immediately and not opening attachments from unknown senders. The use of antivirus software and regular updates are also crucial to protect systems from such attacks.

The malware campaign is another example of the ever-evolving tactics of cybercriminals. The attackers are using increasingly sophisticated methods to achieve their goals and bypass users' security measures. The ongoing digitization of banking makes it easier for criminals to carry out their attacks. Security authorities in Spain and Portugal have already taken steps to inform users about the threat posed by the Ousaban Trojan. Raising awareness about the dangers of phishing and malware is an important step in protecting users.

Authorities plan to conduct intensified information campaigns in the coming weeks. The discovery of the Ousaban Banking Trojan has also drawn the attention of international security organizations. These organizations are working to analyze the threat and develop strategies to better protect users. International cooperation in the field of cybersecurity is considered crucial to effectively address such threats. The security situation remains tense, and users should stay vigilant.

The ongoing development of malware requires constant attention and adaptation of security strategies. Authorities and security organizations are doing everything possible to protect users and prevent the spread of such threats. The vulnerability exploited by the Ousaban Trojan could potentially endanger thousands of users.