Guildma Hides Payloads Behind Brazil Checks

Brad Duncan at SANS ISC found a Guildma (Astaroth) phishing link on August 31 that only delivered malware when opened from a Brazil-based IP with Brazilian Portuguese and Brazil regional settings on a Windows host. Outside that locale, the same link sent a legitimate Android Studio installer instead. The download chain starts with a ZIP file that contains a Windows shortcut. When the target matches Brazil, the shortcut pulls content from a web server and writes it into a Windows alternate data stream inside %LocalAppData%\Temp, where it then stages a DLL that launches the next AutoIt-based payload. That setup means generic sandbox runs and off-locale triage can miss the active payload entirely, so visibility outside Brazil may undercount the campaign. For teams hunting phishing-delivered malware, the exposure sits in the sample-validation workflow as much as on the endpoint itself.

Part of the PlainSec briefing for 2026-09-01

Editions

Sources