Metamorfo is a Brazilian-origin banking trojan that has quietly infiltrated thousands of Windows computers since 2018, focusing primarily on theft of financial credentials, personal data, and remote access to victim machines. Active for over eight years, this malware family demonstrates persistent evolution and remains a significant threat to home users and small businesses who handle online banking. What makes Metamorfo particularly dangerous is its combination of social engineering sophistication and technical capability—it doesn't just steal passwords, it watches your banking sessions in real-time and can manipulate transactions as they happen.
Threat Profile
| Threat Name | Metamorfo (also known as Casbaneiro) |
|---|---|
| Classification | Banking Trojan / Credential Stealer |
| Primary Target | Windows systems (individuals and businesses conducting online banking) |
| File Type | Windows PE executable (often delivered via malicious Office macros) |
| First Observed | Mid-2018 |
| Geographic Focus | Originally Brazil-focused; expanded to Latin America and other regions |
| Distribution Method | Spam email attachments (Office documents with macros), phishing campaigns |
| Primary Capabilities | Banking credential theft, keylogging, screen capture, remote access, transaction manipulation |
| Detection Names | Varies by vendor: Metamorfo, Casbaneiro, BankBot.Metamorfo, Trojan.Banker.Metamorfo |
| Persistence Method | Registry Run keys, Startup folder entries, scheduled tasks |
| Data Exfiltration | Command-and-control servers (C2) via HTTP/HTTPS |
| Intelligence Updated | September 2026 (active threat with ongoing campaigns) |
How It Spreads
Metamorfo relies almost exclusively on social engineering to gain its initial foothold. The threat actors behind it craft convincing spam emails that impersonate banks, tax authorities, delivery services, or government agencies—whatever will get the recipient to open the attachment. These emails often reference invoices, account problems, package deliveries, or tax documents that require "urgent attention." The language and branding are typically localized and surprisingly professional, making them difficult to distinguish from legitimate correspondence at first glance.
The attachment is usually a Microsoft Office document—Word or Excel—that contains malicious macros. When you open the document, you'll see a message claiming the content is "protected" and instructing you to "Enable Content" or "Enable Editing" to view it. This action enables the macro code to run, which then downloads and executes the Metamorfo payload from a remote server. Once that happens, the infection is complete and the trojan begins its work silently in the background.
Common distribution vectors for Metamorfo include:
- Phishing emails with Office attachments — malicious Word/Excel files containing macro downloaders
- Fake invoice and billing emails — impersonating utilities, telecoms, or financial institutions
- Tax document scams — especially during tax season, pretending to be from IRS or state revenue departments
- Package delivery notifications — fake shipping updates from FedEx, UPS, USPS, or regional carriers
- Business email compromise — targeted campaigns against small businesses with payroll/accounting themes
- Malicious links in emails — less common, but some campaigns use links that download infected documents or executables directly
What It Does On Your Machine
Once Metamorfo establishes itself on your system, it operates with a clear mission: monitor your banking activity and steal credentials. The trojan uses multiple techniques to achieve this. It includes keylogging functionality that records everything you type, capturing usernames, passwords, security questions, and PIN codes as you enter them. It also takes periodic screenshots, especially when it detects you've navigated to a banking website or financial portal. Some variants include form-grabbing capabilities that directly intercept data submitted through web forms before it's encrypted.
What sets Metamorfo apart from simpler credential stealers is its interactive capability. The malware connects to a command-and-control server operated by the attackers, establishing a two-way communication channel. This allows the threat actors to issue real-time commands to the infected machine. They can see what you're doing, manipulate windows, display fake overlays that mimic your bank's interface to trick you into entering additional credentials, and even modify transaction details before they're submitted. In some documented cases, victims have initiated legitimate wire transfers only to have Metamorfo silently change the recipient account number before the transaction completes.
The trojan also establishes persistence mechanisms to survive system reboots. It modifies registry keys, drops copies of itself in system directories, and may create scheduled tasks that re-launch it if it's terminated. Here's what a typical Metamorfo infection looks like under the hood:
Metamorfo is also capable of detecting and adapting to virtualized or sandbox environments in some variants, which makes automated analysis more difficult. It may check for the presence of security software and alter its behavior accordingly—lying dormant or mimicking legitimate processes to avoid detection. For the average user, the only visible symptoms might be occasional slowdowns, brief flickering of windows during banking sessions, or unexplained account activity discovered later.
Manual Removal — Step by Step
Disconnect From the Internet
Unplug the Ethernet cable or disable Wi-Fi immediately. This severs Metamorfo's connection to its command-and-control server and prevents further data exfiltration or remote commands. Do not reconnect until the removal process is complete and verified.
Boot Into Safe Mode With Networking
Restart your computer and repeatedly press F8 (or Shift+F8 on Windows 10/11) during boot to access Advanced Boot Options. Select "Safe Mode with Networking." This loads Windows with minimal drivers and services, preventing most malware from launching automatically and making removal easier.
Run a Full System Scan With Updated Antivirus
Update your antivirus definitions (you'll need the networking capability for this), then run a complete system scan. Most modern antivirus software can detect Metamorfo under various names. Quarantine or delete any threats found. If you don't have current antivirus protection, download and run Malwarebytes or Microsoft Defender Offline from a clean computer, transfer it via USB.
Check Startup Programs and Scheduled Tasks
Press Ctrl+Shift+Esc to open Task Manager, then click the "Startup" tab. Look for unfamiliar entries, especially those with generic names or pointing to AppData or Temp directories. Disable suspicious items. Then open Task Scheduler (taskschd.msc) and review scheduled tasks for anything referencing unusual executables or scripts.
Inspect Registry Run Keys
Open Registry Editor (regedit.exe) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries with unfamiliar names or paths pointing to user directories. Delete suspicious entries, but be cautious—legitimate programs also use these keys. Document what you remove in case you need to restore something later.
Delete Malicious Files and Folders
Navigate to the directories flagged by your antivirus scan or identified in the registry. Common Metamorfo locations include C:\Users\[Username]\AppData\Roaming\, C:\Users\[Username]\AppData\Local\Temp\, and occasionally C:\ProgramData\. Delete suspicious executables and data files. Enable viewing of hidden files in File Explorer settings to see these directories.
Clear Browser Data and Extensions
Metamorfo sometimes installs browser extensions or injects code into browser processes. Open each browser you use, access settings, and remove unfamiliar extensions. Then clear all browsing data including cookies, cached files, and saved passwords. This is also a good precaution since Metamorfo may have captured session tokens.
Reboot and Verify
Restart your computer normally (not in Safe Mode) and monitor for unusual behavior. Run another antivirus scan to confirm removal. Check Task Manager for suspicious processes consuming resources. Test your banking websites but do not log in yet—first change your passwords from a known-clean device.
Change All Financial Passwords From a Clean Device
Using a different computer, tablet, or phone that was not infected, immediately change passwords for all banking, credit card, PayPal, investment accounts, and any other financial services. Enable two-factor authentication wherever available. Contact your bank's fraud department to notify them of the potential compromise and monitor your accounts closely for unauthorized transactions.
Consider a Full System Restore or Reinstall
Banking trojans like Metamorfo can be persistent and may have installed rootkit components that are difficult to fully remove. If you have any doubts about whether the system is clean—or if antivirus scans continue to find components after removal attempts—the safest approach is to back up your personal files (documents, photos, but not executables), format the drive, and perform a clean Windows installation. This is the only way to be absolutely certain the infection is gone.
Prevention
- Never enable macros in Office documents from email attachments unless you are absolutely certain of the sender's legitimacy and were expecting the file. Microsoft disabled macros by default for good reason—malware campaigns like Metamorfo rely on users enabling them.
- Verify sender identity before opening attachments by calling the supposed sender using a phone number you look up independently (not one provided in the email). Attackers spoof "From" addresses routinely. If your bank sends you an email with an attachment, log into your account directly through their website or call them instead of clicking links or opening files.
- Keep Windows and all software updated with the latest security patches. Enable automatic updates for your operating system, browsers, Adobe products, and Java. Many malware campaigns exploit known vulnerabilities that have been patched—but only if you've installed the patches.
- Use reputable antivirus software and keep it updated. While antivirus isn't perfect and Metamorfo variants sometimes slip past detection initially, security software catches most infections and significantly raises the bar for attackers. Enable real-time protection and scheduled scans.
- Implement email filtering that blocks executable attachments and scans Office files for malicious macros. Many email providers offer this as a standard feature. For business accounts, consider gateway-level email security that sandboxes attachments before delivery.
- Practice least-privilege computing—don't use an administrator account for daily work. Run with a standard user account and only elevate privileges when necessary for software installation or system changes. This limits what malware can modify if it gets through.
- Enable two-factor authentication on all banking and financial accounts. While Metamorfo can still cause damage, 2FA makes it significantly harder for attackers to access your accounts even if they've stolen your password. Use app-based authenticators rather than SMS when possible.
- Monitor your accounts regularly for unauthorized transactions. Set up account alerts for transactions over a certain threshold, login attempts from new devices, or account information changes. The sooner you catch fraudulent activity, the easier it is to reverse and contain the damage.
Bring It In
Banking trojan infections like Metamorfo require urgent professional attention. The financial risk is simply too high to rely on automated scans alone—these threats are sophisticated, deliberately designed to evade detection, and can persist in hidden locations that manual removal attempts miss. Computer Repair Roswell has extensive experience with credential-stealing malware. We perform forensic-level analysis to identify all infection components, remove the threat completely, verify system integrity, and implement security measures to prevent reinfection. We also help you understand how the infection occurred and what steps you need to take with your financial institutions.
Our shop is located in Roswell, Georgia, and we offer same-day service for malware emergencies. Bring your computer in or call us at (770) 954-1673 to schedule an appointment. If you're dealing with an active Metamorfo infection, time matters—the longer the malware remains active, the more data it can steal and the greater the potential for financial loss. Let us handle the technical complexities while you focus on securing your accounts and protecting your finances. We serve Roswell and surrounding communities with honest, professional computer repair and security services you can trust.