Threat intelligence / Malware

Mispadu

[Mispadu](https://attack.mitre.org/software/S1122) is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: SCILabs Malteiro 2021) This malware is operated, managed, and sold by the [Malteiro](https://attack.mitre.org/groups/G1026) cybercriminal group.(Citation: SCILabs Malteiro 2021) [Mispadu](https://attack.mitre.org/software/S1122) has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.(Citation: SCILabs Malteiro 2021)(Citation: SCILabs URSA/Mispadu Evolution 2023)(Citation: Segurança Informática URSA Sophisticated Loader 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Mispadu](https://attack.mitre.org/software/S1122) is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: SCILabs Malteiro 2021) This malware is operated, managed, and sold by the [Malteiro](https://attack.mitre.org/groups/G1026) cybercriminal group.(Citation: SCILabs Malteiro 2021) [Mispadu](https://attack.mitre.org/software/S1122) has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.(Citation: SCILabs Malteiro 2021)(Citation: SCILabs URSA/Mispadu Evolution 2023)(Citation: Segurança Informática URSA Sophisticated Loader 2020)

Labels

malware

27 recorded

Relationships

uses

Group

uses

to Asymmetric Cryptography

Technique

uses

to Browser Extensions

Technique

uses

to Browser Information Discovery

Technique

uses

to Clipboard Data

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to GUI Input Capture

Technique

uses

Technique

uses

to Malicious File

Technique

uses

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to Spearphishing Link

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to Visual Basic

Technique

5 external

References

mitre-attack

S1122

ESET Security Mispadu Facebook Ads 2019

https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/

Segurança Informática URSA Sophisticated Loader 2020

https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/

SCILabs Malteiro 2021

https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/

SCILabs URSA/Mispadu Evolution 2023

https://blog.scilabs.mx/en/evolution-of-banking-trojan-ursa-mispadu/