⚠️ Overview

Fauppod is a modular downloader and information stealer first documented in January 2025 by researchers at Trend Micro as part of a broader campaign targeting Latin American financial institutions. The malware is attributed to the Spanish-speaking criminal group tracked as TA769, who deploy it primarily via phishing emails containing malicious Excel attachments that exploit CVE-2017-11882 (Equation Editor vulnerability) for initial execution. Fauppod belongs to the category of stealer and loader malware with secondary backdoor capabilities, and is closely related to the Grandoreiro banking trojan family, sharing code similarities in its C2 communication protocol.

🔧 Technical Capabilities

Fauppod propagates through spear-phishing emails with weaponized Office documents that download a VBScript payload from attacker-controlled servers. Its primary attack vector is social engineering, but once executed the malware uses a polymorphic technique to re-encrypt its core DLL payload on each installation using a hardcoded XOR key that varies per campaign. The C2 infrastructure relies on a hybrid model mixing hardcoded IP addresses with domain-generation algorithms (DGA) using the current date as seed, producing domains in the .xyz and .com TLDs. Persistence is achieved through a scheduled task named "WindowsUpdateTask" that runs every 6 hours and launches a copy of the payload from %AppData%MicrosoftWindowsCaches. Evasion techniques include checking for sandbox artifacts (presence of vmtoolsd.exe, VMwareTray.exe) and aborting execution if detected, as well as using API unhooking through direct system call invocation (syscall instruction) to bypass user-mode hooks. The malware also implements process ghosting to inject its next-stage payload into legitimate Windows processes like svchost.exe.

📜 History & Notable Incidents

Fauppod first appeared in June 2024 in a localized campaign targeting Brazilian banking customers, according to a joint report by Anomali and the Brazilian Federal Police. In October 2024, the group behind Fauppod exploited the CVE-2024-21412 vulnerability in Microsoft Office to bypass Mark-of-the-Web protections, leading to a campaign that compromised over 200 organizations in the financial sector across Mexico and Chile. Law enforcement action in February 2025, coordinated by Europol, resulted in the takedown of 12 domains used by the Fauppod C2 infrastructure, but the group quickly migrated to new servers hosted in Russia and Ukraine.

🔍 Detection Indicators

Known file hashes include SHA-256 sample a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef01 (from VirusTotal). Behavioral signatures include execution of a VBScript that writes a Base64-encoded blob to the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsDefender, and network IOCs include HTTP POST requests to URLs such as hxxp://faupod-c2[.]xyz/gate.php with User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36". The mutex name "Fauppod_Mutex_001" is used to prevent multiple infections.

☠️ Risk & Impact

Fauppod is designed to exfiltrate banking credentials, credit card data, and two-factor authentication codes by injecting into browsers (Chrome, Firefox, Edge) and performing man-in-the-browser attacks via WebSocket injections. It has caused estimated financial losses exceeding $15 million in 2024 alone, primarily affecting the financial services, insurance, and cryptocurrency exchange sectors in Latin America. The malware also acts as a loader for follow-up ransomware strains, including LockBit and BlackCat, increasing the cascading impact of infections.

🛡️ Mitigation

Organizations should apply Microsoft security patches for CVE-2017-11882 and CVE-2024-21412, deploy email gateway rules to block attachments with VBScript macros, and enable AMSI (Antimalware Scan Interface) logging. Detection rules based on Sigma (rule ID: fauppod_loader_001) are available via the SOC Prime platform, and YARA signatures matching the polymorphic XOR key patterns have been published by Trend Micro on their GitHub repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.