A banking trojan long used against victims in Brazil has been retooled to target banking customers in Spain and Portugal, using phishing PDFs, steganography and geofencing to stay hidden. In a new analysis, Fortinet's FortiGuard Labs said the malware, known as Ousaban, has been active against the two countries since May 2026. A banking trojan from the same Latin American family as Casbaneiro, it now comes wrapped in extra layers of evasion designed to keep it in front of intended victims and away from researchers. A Phishing Chain Built to Screen Victims The attack starts with a phishing PDF disguised as a broken file, which nudges the victim to click an Update button that opens a malicious webpage. Posing as a government tax portal, the page profiles each visitor and only continues the…