X-Industry

In April 2025, FortiGuard Labs observed a threat actor using phishing emails with malicious HTML files to spread Horabot, malware that primarily targets Spanish-speaking users.  It is known for using crafted emails that impersonate invoices or financial documents to trick victims into opening malicious attachments and can steal email credentials, harvest contact lists, and install banking trojans.

Horabot leverages Outlook COM automation to send phishing messages from the victim’s mailbox, enabl

Since 2018, Proofpoint researchers have tracked a financially-motivated cybercrime actor, TA558, targeting hospitality, travel, and related industries located in Latin America and sometimes North America, and western Europe.  The actor sends malicious emails written in Portuguese, Spanish, and sometimes English.  The emails use reservation-themed lures with business-relevant themes such as hotel room bookings.  The emails may contain malicious attachments or URLs aiming to distribute one of at l