Loading malware…
Mispadu is a Latin American banking trojan focused primarily on Windows systems and historically associated with campaigns targeting Spanish- and Portuguese-speaking users, especially in Mexico and nearby regions. It is part of the broader LATAM banking malware ecosystem that includes families such as Grandoreiro, Guildma, Casbaneiro, Mekotio, and Amavaldo, which share overlapping tradecraft, similar obfuscation approaches, and closely related distribution patterns. Mispadu has been described as one of the more prominent banking malware families active in Mexico and has also been observed targeting financial and cryptocurrency institutions.
Mispadu commonly relies on user execution as part of multistage infection chains. Observed campaigns have used spam with invoice-themed lures to deliver archive files containing Windows Installer packages and heavily obfuscated scripts, which then launch intermediate loaders before injecting or loading the final Delphi payload into memory. Across the LATAM banking trojan ecosystem, MSI-based first stages, ZIP archives, scripting languages such as VBScript, and DLL side-loading are recurring execution patterns, and Mispadu has been linked to these broader operational practices.
Once active, Mispadu performs environmental checks to restrict execution to intended victims and reduce analysis exposure. It checks system language settings and terminates if the host is not configured for Spanish or Portuguese locales. It has also been reported to enumerate installed security products in the victim environment, reflecting both discovery and defense-evasion objectives. Campaign samples have additionally used anti-virtualization checks before continuing execution.
Its core functionality centers on banking fraud and credential theft. Mispadu steals credentials from browsers including Google Chrome, can harvest credentials from mail clients through bundled NirSoft utilities, monitors browser activity related to online banking, and displays fraudulent banking overlays to capture victim-entered data. It also exfiltrates collected financial information to attacker-controlled infrastructure. Beyond banking credential theft, Mispadu includes clipboard hijacking functionality that can capture and replace copied cryptocurrency wallet data, indicating overlap between banking fraud and crypto-theft monetization.
Mispadu communications have been observed using encrypted command-and-control traffic, including use of OpenSSL in some variants. The malware family is part of a cluster of closely cooperating Latin American banking trojan operators that emphasize social engineering, manual fraud workflows, and regional targeting over fully automated post-compromise operations. More recent reporting indicates that infrastructure and delivery tactics previously associated with Mispadu were later reused by the same actor to distribute other payloads, underscoring the adaptability of the operators behind these campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Mispadu checks and will terminate execution if the compromised system’s language ID is not Spanish or Portuguese.
TA2725 is a threat actor Proofpoint tracked since March 2022 that is known for using Brazilian banking malware (including Mispadu, Astaroth, and historically Grandoreiro) and credential phishing to target organizations mainly in Brazil, Mexico, and Spain.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
157 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking trojan identified as active in Mexico.
Referenced only as related reading about Latin American banking malware; no campaign details are provided in this content.
Banking trojan/stealer targeting financial and cryptocurrency institutions in Mexico.
Banking trojan targeting Latin America (notably Mexico and Brazil) delivered via phishing with HTA attachments (sometimes via password-protected PDFs); uses an AutoIT loader and dynamically generated delivery artifacts to frustrate EDR; includes self-propagation via email and expanded targeting to banks outside LATAM and crypto exchanges.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.