Hesperbot-Trojan-Warning.pdf

**Executive summary:** This white paper presents a technical analysis of the Win32/Spy.Hesperbot banking Trojan used in active phishing campaigns across Turkey, the Czech Republic, Portugal and the United Kingdom; Hesperbot employs a modular architecture (dropper, core, interception and injection modules), a local proxy MITM with fake certificate handling, keylogging, screenshot/video capture, hidden VNC for remote access and a mobile component to steal mTANs, and the report includes targeted bank lists, campaign timeline and IoCs (domains and MD5s).