Risk Actors Leverage Weaponized HTML Recordsdata to Ship Horabot Malware

A current discovery by FortiGuard Labs has unveiled a crafty phishing marketing campaign orchestrated by risk actors deploying Horabot malware, predominantly concentrating on Spanish-speaking customers in Latin America.

This high-severity risk, detailed within the 2025 International Risk Panorama Report, exploits malicious HTML information embedded in phishing emails to steal delicate data, together with e-mail credentials and banking knowledge, whereas propagating by means of company and private networks.

Lively since no less than April 2025, the marketing campaign focuses on customers in international locations similar to Mexico, Guatemala, Colombia, Peru, Chile, and Argentina, utilizing culturally tailor-made emails masquerading as authentic invoices to deceive victims.

– Commercial –

Subtle Phishing Marketing campaign

The assault begins with a phishing e-mail written in Spanish, usually claiming to incorporate a PDF bill underneath topic strains like “Factura Adjunta” (Connected Bill).

These emails lure recipients into opening a ZIP attachment containing a malicious HTML file with Base64-encoded knowledge.

As soon as decoded, the HTML reveals a distant URL that downloads a secondary payload, a ZIP file named “ADJUNTOS_23042025.zip,” housing an HTA file.

In response to Fortinet Report, this file employs browser redirection methods and masses additional malicious scripts, initiating a fancy an infection chain involving VBScript, AutoIt, and PowerShell.

The VBScript, hosted on distant servers, makes use of customized string decoding to evade static detection, performing duties like atmosphere checks for antivirus software program (e.g., Avast) and digital machines, alongside creating persistence mechanisms through shortcuts in startup folders.

It additionally orchestrates knowledge exfiltration by accumulating system information-such as IP addresses and usernames-and sending it to command-and-control (C2) servers.

Multi-Stage Assault Chain

Subsequent payloads embody an AutoIt script that decrypts a malicious DLL with a hardcoded key, enabling the theft of browser knowledge from functions like Google Chrome, Microsoft Edge, and Opera, whereas deploying faux pop-up home windows to seize login credentials.

Concurrently, PowerShell scripts exploit Outlook COM automation to reap e-mail contact lists, filter out particular domains (e.g., Gmail, Hotmail), and ship tailor-made phishing emails with malicious attachments to new victims, making certain lateral unfold inside networks.

This self-propagating mechanism, mixed with cleanup routines to erase traces, renders Horabot notably stealthy and difficult to detect because it blends seamlessly with authentic Home windows and Outlook behaviors.

FortiGuard Labs emphasizes the rising sophistication of such phishing assaults, urging organizations to implement strong e-mail filtering, monitor for anomalous file exercise, and educate workers on recognizing phishing makes an attempt.

Fortinet’s safety options, together with FortiGate and FortiMail, detect and block this malware underneath signatures like HTML/Phishing.683A!tr and AutoIt/Agent.HA!tr, providing safety to prospects with up to date programs.

Moreover, free cybersecurity coaching from Fortinet is really useful to bolster consumer consciousness.

Indicators of Compromise (IOCs)

Discover this Information Attention-grabbing! Observe us on Google Information, LinkedIn, & X to Get On the spot Updates!