Loading story…
The Grandoreiro banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, DLL side-loading, and malicious VBS scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments.
The latest variants use stronger evasion and persistence techniques, including binary padding to roughly 400MB, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including Google Cloud, Microsoft Azure, and Amazon. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
WatchGuard identified active Grandoreiro campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America. The campaigns used two delivery chains: DLL side-loading via phishing ZIP files and a geofenced malicious VBS script hosted through abused legitimate services.
A later reference states that the Grandoreiro banking trojan has been active since 2016, establishing the start of the malware's known operations.
Forcepoint X-Labs reported a revived Grandoreiro phishing campaign targeting users in Mexico, Argentina, and Spain with emails impersonating tax agencies. The campaign used Contabo-hosted infrastructure, MediaFire-delivered ZIP archives, and an obfuscated VBS dropper that executed a Delphi payload communicating with command-and-control servers on unusual ports.
The Record reported that Brazilian police made arrests in connection with the Grandoreiro banking malware case.
Researchers observed a Grandoreiro variant using phishing-delivered ZIP archives with a loader disguised as a PDF, followed by retrieval of a Delphi payload from a remote HTTP server. The variant added stronger anti-analysis and evasion features, including binary padding, CAPTCHA-based execution, registry persistence, and a DGA-based command-and-control system.
Zscaler identified an ongoing Grandoreiro campaign that began in June 2022, targeting employees at a chemicals manufacturer in Spain and automotive and machinery companies in Mexico through phishing emails impersonating government entities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcewatchguard.com
Open sourceforcepoint.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **Grandoreiro** banking trojan has continued operating globally despite law-enforcement disruptions and arrests, expanding from targeting about **900 banks in 40 countries** in 2023 to roughly **1,700 banks and 276 crypto wallets across 45 countries and territories** in 2024. Telemetry recorded more than **150,000 blocked infection attempts** affecting over **30,000 users** worldwide between January and October 2024, underscoring the malware’s sustained scale and resilience. Recent Grandoreiro campaigns used phishing emails, malvertising, **MSI-based loaders**, **DLL sideloading**, oversized padded binaries, and **CAPTCHA-based sandbox evasion** to infect victims. Kaspersky said newer versions also introduced fragmented codebases, stronger encryption, three domain generation algorithms for command-and-control, and mouse-behavior tracking to evade fraud detection, while preserving core capabilities including remote machine control, credential theft, one-time-password harvesting through overlays, clipboard replacement for cryptocurrency theft, and fraudulent banking transactions; some legacy variants are now concentrating on targets in Mexico.
Jun 29, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026
Fortinet reported an ongoing **Ousaban** banking Trojan campaign targeting Microsoft Windows users in Spain and Portugal, using phishing PDFs disguised as corrupted documents to redirect victims to malicious webpages. The operation applies geofencing and environment checks to limit infections to Iberian targets, then delivers a VBS script that extracts a hidden ZIP archive from an image and executes the final payload. Researchers said the campaign marks an evolution from late-2025 Ousaban activity that relied on MSI installers and ClickFix-style lures. Once installed, Ousaban establishes persistence through a Windows Registry `Run` key named `Financeiro` and waits for victims to access banking services. The malware supports **remote control, keylogging, screenshot capture, clipboard manipulation, and fake on-screen messages** to facilitate account takeover. Fortinet said the operators no longer depend on a decoy Pastebin configuration for command-and-control, instead resolving infrastructure through daily changing DDNS hostnames generated from the current date, a tactic that adds resilience and complicates detection.
Jul 2, 2026