Do not click links in emails claiming "Invoice Overdue" or "Account Verification."

Restrict compressed files from unknown external senders.

Por_Ela.rar , Fatura_Vencida.rar , Documento_Digital.rar

Inside is usually a large .EXE or .MSI file (often over 100MB to evade sandbox detection).

It scans for specific window titles related to banking applications.