A banking session can remain genuine while the screen deceives
Pedro Tavares reports a Portugal-targeting campaign in which fake electricity invoices deliver Recorteiro, a Rust banking trojan also described using the WindowsHelpers and CryptoPRO-X names. The reported fraud interface can cover the screen while leaving an opening over the genuine bank page. The victim can therefore enter information into the real site while an operator controls the wider session. Seeing the correct bank domain does not, by itself, establish that the endpoint or transaction is safe. Original analysis
The research describes an invoice ZIP leading through batch and PowerShell stages to a Rust loader and a separately downloaded core. The loader installs persistence and supervises that core. The core supports remote interaction over WebRTC and receives targeting information from its server. The researcher’s lab target list and timing observations describe the tested environment; they are not a census of affected bank customers. Original analysis
Why the loader and core both matter
The analysis reports per-machine changes to the installed core that alter its file hash. A response based only on one published hash can consequently miss related files. That does not make hashing useless: an exact match remains useful evidence, while the absence of that match is a narrower finding than the absence of infection. The report also distinguishes inventorying security products from actively killing them. These behaviours should not be conflated. Original analysis
TIR’s defensive interpretation is to investigate the whole installation sequence. Correlate an invoice archive with script interpreters, newly created executables in user-writable locations and persistence changes. Preserve the archive and endpoint artefacts so that the loader and banking core can be assessed together. Randomised names are a reason to consider relationships and behaviour, rather than an independent detection verdict.
Contain fraud as well as malware
If a banking session may have been controlled from an infected workstation, contact the bank’s fraud team through a trusted channel and review recent transactions. Account recovery should take place from a clean device. Preserve the timing of the suspected session so bank-side and endpoint investigations can be compared.
For an organisation, isolate the host and review other credentials accessible from it. Removing the visible overlay is not proof that remote access or persistence has ended. For users, an invoice advertised as a PDF but delivered as a script-containing archive should be verified with the supplier through an independently obtained contact route before execution.
The use of Rust identifies an implementation choice. It does not independently prove novelty, authorship or superior evasion. The article’s operational concern is the combination of staged installation, persistent remote access and deception around a real banking session.
