Horabot Malware Strikes Latin America Through Sneaky Invoice Emails

Horabot Malware Strikes Latin America Through Sneaky Invoice Emails

Summary

• Horabot malware targets Spanish-speaking users in Latin America, stealing banking and email credentials.
• Phishing emails are the main delivery method, using fake invoices to trick recipients.
• Impact includes stolen logins, bank fraud and further phishing sent from victims’ own mailboxes.
• Defenders are urged to block malicious attachments and teach users to spot invoice scams.

Criminals keep finding new ways to trick people into opening the door. In Latin America, a malware family called Horabot has been doing it with something very ordinary: an invoice.

What Horabot Is

Horabot is a malware campaign first documented by Cisco Talos in 2023 and tracked again by Fortinet’s FortiGuard Labs in 2025. It targets Spanish-speaking users in countries such as Mexico and Colombia, along with others in the region. It arrives in a phishing email posing as an invoice and is built to steal banking and email credentials.

How It Spreads

The email usually carries an HTML attachment named like an invoice. Opening it starts a chain of scripts that downloads and runs the malware. The emails push the recipient to act fast, which makes people less careful.

Fortinet found that the attack uses a chain of scripts to set itself up and avoid detection. It also checks the system and skips certain environments, such as those used by security researchers.

Once installed, Horabot shows fake login windows for banks to capture credentials. It also takes over the victim’s Outlook or webmail and sends the same phishing email to everyone in their contacts, which helps it spread from one trusted inbox to the next.

Impact on the Region

The damage can be serious. Stolen banking credentials lead to direct fraud, and stolen email accounts let attackers run more convincing scams. Small businesses that pay invoices by email are especially exposed.

Because the phishing emails come from real contacts, recipients are much more likely to trust them.

Regional banks and their customers are a natural target. Smaller institutions often have fewer fraud controls than large international banks.

How Defenders Are Responding

Security firms have published indicators of compromise and detection rules for Horabot. Email filters can block the HTML attachments and scripts it uses, and endpoint tools can flag the suspicious script chain.

User awareness matters too. Teach staff to check invoice emails with the sender through another channel, and to be suspicious of attachments that open a browser page asking them to download something.

Practical Steps

Horabot shows how much mileage criminals still get from basic phishing. Block risky attachment types. Turn on multi-factor authentication for email and banking. Report odd invoices. Do not open them.

One Old Trick, Still Working

Horabot is a reminder that malware does not need to be new to work. For businesses and individuals in Latin America, the best defense is a mix of good email filtering and healthy suspicion.

Invoice scams work because paying invoices is routine. A two-minute check with the sender before opening an attachment or paying a bill can stop them cold.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.