Brad Duncan at SANS ISC found a Guildma (Astaroth) phishing link on August 31 that only delivered malware when opened from a Brazil-based IP with Brazilian Portuguese and Brazil regional settings on a Windows host. Outside that locale, the same link sent a legitimate Android Studio installer instead.
The download chain starts with a ZIP file that contains a Windows shortcut. When the target matches Brazil, the shortcut pulls content from a web server and writes it into a Windows alternate data stream inside %LocalAppData%\Temp, where it then stages a DLL that launches the next AutoIt-based payload.
That setup means generic sandbox runs and off-locale triage can miss the active payload entirely, so visibility outside Brazil may undercount the campaign. For teams hunting phishing-delivered malware, the exposure sits in the sample-validation workflow as much as on the endpoint itself.