Mispadu Banking Trojan Exploits Windows SmartScreen Bypass Flaw: Cyber Threats Targeting Mexican Users

The Mispadu banking Trojan has resurfaced with a new variant exploiting a now-patched Windows SmartScreen security bypass flaw to compromise users in Mexico. Palo Alto Networks Unit 42 discovered the latest infection chain using rogue internet shortcut files within deceptive ZIP archives. This attack vector leveraged CVE-2023-36025, a high-severity flaw addressed by Microsoft in November 2023. Mispadu, part of the LATAM banking malware family, selectively targets victims based on geographic location and system configurations. The Windows SmartScreen bypass flaw has been recently exploited by various cybercrime groups, adding to the complexity of cyber threats. Mexico continues to be a prime target for campaigns deploying information stealers and remote access trojans, highlighting the persistent financial motivations behind such attacks.