Loading story…
ESET detailed the Vadokrist banking trojan as an actively developed malware family focused almost exclusively on Brazil, with tracking dating back to 2018. Written in Delphi, the malware includes backdoor capabilities commonly used in banking fraud, including mouse and keyboard control, keylogging, screenshots, and browser disruption. Researchers said Vadokrist also contains substantial unused code that appears intended to complicate analysis, and it relies on encrypted remote configuration files—often hosted on public storage services—to obtain command-and-control information and downloader instructions.
Recent campaigns distributed Vadokrist through spam emails carrying nested ZIP archives that ultimately delivered MSI and CAB files, followed by JavaScript-based persistence and direct installation of the trojan without a separate downloader in that infection chain. ESET said the malware uses a custom "TripleKey" cryptographic scheme also seen in other Latin American banking trojans, with occasional use of RC4 and historical use of TwoFish, and noted infrastructure and development similarities with Amavaldo, Casbaneiro, Grandoreiro, and Mekotio, indicating shared tradecraft across the regional banking-malware ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ESET published a detailed analysis of Vadokrist covering its Delphi codebase, anti-analysis padding, cryptography, distribution chains, persistence, remote configuration, and similarities with other Latin American banking trojans. The report also described recent MSI-based spam delivery that installs the trojan directly.
ESET reported that it has tracked the Vadokrist Latin American banking trojan since 2018. The malware operates almost exclusively in Brazil.
4 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that several major Latin American banking trojan families—including **Amavaldo, Casbaneiro, Mispadu, Guildma, Grandoreiro, and Mekotio**—are distinct malware operations that nonetheless share extensive code, delivery logic, and operational techniques. Researchers said the overlap spans uncommon libraries, obfuscation methods, domain generation algorithms, string-encryption routines, and near-identical banking-trojan behavior, indicating close cooperation among financially motivated threat actors rather than coincidence. The campaigns commonly use **spearphishing attachments and links** to deliver payloads, often through **ZIP archives**, malicious documents, and **MSI installers**, with **Visual Basic–based scripts and macros** used for execution and staging. Once launched, the malware typically establishes persistence through Registry `Run` keys or Startup folders, uses DLL side-loading, and steals banking credentials through fake pop-up windows, keylogging, screenshots, and security-software discovery; ESET also noted that several of these families expanded beyond Latin America to target victims in **Spain and Portugal**.
Aug 15, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026
Kaspersky reported that the **Grandoreiro** banking trojan has continued operating globally despite law-enforcement disruptions and arrests, expanding from targeting about **900 banks in 40 countries** in 2023 to roughly **1,700 banks and 276 crypto wallets across 45 countries and territories** in 2024. Telemetry recorded more than **150,000 blocked infection attempts** affecting over **30,000 users** worldwide between January and October 2024, underscoring the malware’s sustained scale and resilience. Recent Grandoreiro campaigns used phishing emails, malvertising, **MSI-based loaders**, **DLL sideloading**, oversized padded binaries, and **CAPTCHA-based sandbox evasion** to infect victims. Kaspersky said newer versions also introduced fragmented codebases, stronger encryption, three domain generation algorithms for command-and-control, and mouse-behavior tracking to evade fraud detection, while preserving core capabilities including remote machine control, credential theft, one-time-password harvesting through overlays, clipboard replacement for cryptocurrency theft, and fraudulent banking transactions; some legacy variants are now concentrating on targets in Mexico.
Jun 29, 2026