Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

Peninsula | FortiGuard Labs

By Rachael Liao

Affected Platforms: Microsoft Windows

Impacted Users: Microsoft Windows

Impact: The stolen information can be used for future attacks

Severity Level: High

In May 2026, FortiGuard Labs identified an attack targeting users in Spain and Portugal involving the banking Trojan Ousaban. This malware has been active in Brazil and is spread through an MSI downloader. The malicious payload involves a DLL file that is run via DLL side-loading or process injection.

In this campaign, the threat actor primarily targets use…