Loading story…
Proofpoint reported a renewed Retefe banking Trojan campaign targeting online banking users in Switzerland, Germany, and Liechtenstein, with operators shifting tactics to improve stealth and credential theft. Rather than relying mainly on web injects, Retefe redirected victim banking traffic through a proxy, and in one observed Switzerland-focused campaign an OLE-based lure document delivered Smoke Loader, which then fetched the banking malware. Researchers also noted infrastructure and tooling changes, including the replacement of Tor with stunnel for encrypted tunneling and the use of a shareware application, Convert PDF to Word Plus 1.0, in the infection chain.
The campaign also expanded its reach to macOS users by distributing fake Adobe installer applications signed with a developer certificate, a technique designed to help the malware pass Apple Gatekeeper checks and appear trustworthy when opened on a Mac. The activity showed that Retefe operators were actively refining cross-platform delivery, downloader selection, and trust-abuse methods to sustain banking credential theft against regional financial institutions and their customers.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
On 2019-04-17, Proofpoint observed a geographically targeted Retefe campaign against Switzerland. The lure document used an OLE package to deliver Smoke Loader, which later downloaded Retefe.
The report states that Retefe returned to more regular attacks against Swiss and German victims in April 2019. This resurgence included operational changes such as using stunnel instead of Tor and Smoke Loader instead of sLoad.
In March 2019, Proofpoint researchers identified an abused "Convert PDF to Word Plus 1.0" installer in a public malware repository. The backdoored application was later described as part of Retefe's 2019 infection chain.
The report says Retefe campaigns targeting macOS continued through the first several months of 2019. These campaigns used fake Adobe installer applications signed with developer certificates to help bypass Gatekeeper protections.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 90 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Retefe** banking Trojan was used in phishing campaigns targeting organizations in **Sweden, Switzerland, and Japan**, where it intercepted online banking sessions by installing a rogue root certificate and changing proxy settings to route traffic through attacker-controlled infrastructure. Rather than relying on traditional browser hooking alone, the malware used **PowerShell** to enable man-in-the-middle interception of financial traffic, and infections also deployed **Smoke Loader** as a secondary payload for credential theft and additional malware delivery. Technical analysis of later Retefe variants showed the malware’s embedded **JavaScript** payload was hidden in the PE file’s `.data` segment and decoded with a **4-byte XOR key** derived from the script length and arithmetic operations. Researchers documented an unpacking workflow that used **YARA** to locate decoding parameters, calculate the buffer RVA, derive the XOR array, and recover the script, highlighting how the malware’s packing and storage methods evolved from earlier variants while preserving its banking-focused intrusion model.
Aug 15, 2026
Proofpoint reported that the **Kronos banking Trojan** resurfaced in multiple campaigns after a period of inactivity, with operations aimed at users in **Germany, Japan, and Poland** and a fourth campaign that appeared to still be in testing. The malware preserved core banking-Trojan capabilities including **man-in-the-browser webinjects**, **keylogging**, **hidden VNC**, and **Zeus-formatted injects**, while shifting command-and-control traffic to **Tor `.onion` services**. Researchers observed targeting of **five German financial institutions** and **thirteen Japanese financial institutions**, while the Polish sample had no active webinjects during analysis.
Aug 14, 2026
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026