Threat actors have been observed conducting a sophisticated phishing campaign aimed at the Latin American region, specifically targeting Windows systems with malicious payloads. The campaign begins with phishing emails containing ZIP files that, upon extraction, reveal HTML files directing users to download disguised malicious invoices. These emails appear to originate from a domain employing “temporary[.]link” and are tailored to evade detection by behaving differently based on the recipient’s IP address’ geolocation, particularly targeting users in Mexico. The malware involved in this campaign is complex, designed to gather system information, check for antivirus defenses, and deploy additional malicious files from Dropbox. This operation bears resemblance to the tactics used in past Horabot malware campaigns, which also focused on Spanish-speaking users in Latin America. In addition to this phishing scheme, cybersecurity researchers have also uncovered a malvertising campaign exploiting Microsoft Bing users with counterfeit NordVPN ads leading to the download of a remote access trojan called SectopRAT, as well as a fake Java Access Bridge installer that deploys a cryptocurrency miner. Furthermore, a Golang-based malware has been discovered in recent campaigns, showcasing advanced evasion techniques such as geolocation checks and installing a root certificate for secure communication with its command-and-control (C2) server. These incidents underscore the evolving sophistication of cyber threats and the need for vigilance among users and cybersecurity professionals alike, especially in the context of region-specific targeting and the exploitation of popular software and services.