Loading story…
Brazilian Federal Police, supported by ESET, Interpol, Spain’s National Police, and Caixa Bank, disrupted the Grandoreiro banking trojan operation and arrested five suspects tied to its infrastructure. Investigators said the malware crew had been active since at least 2017, primarily targeting Spain, Mexico, Brazil, and Peru, and used the trojan to conduct hands-on banking fraud through credential phishing, remote interaction with victims’ machines, screen monitoring, and keylogging. Authorities said the group moved at least €3.6 million through fraud since 2019, while Caixa Bank linked the operators to roughly $120 million in losses.
Grandoreiro was distributed through spam campaigns using fake Java or Flash updates and other lures, including COVID-19-themed messages, with payloads often delivered in encrypted ZIP archives via public file-sharing services. ESET said the Delphi-based malware used a modular design with bank-specific DLLs, a domain generation algorithm (DGA) for command-and-control discovery, registry-stored configuration, startup-folder persistence, and evasion features such as binary padding and anti-emulation; it also stole credentials from Chrome and Outlook and attempted to disable banking protection tools. By tracking the DGA and clustering command-and-control servers, researchers estimated about 551 daily unique connections and 114 new daily victims, and said the law-enforcement action appears to have halted the operation for now, though a return on new infrastructure remains possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Brazilian Federal Police, supported by ESET, Interpol, Spain's National Police, and Caixa Bank, disrupted the Grandoreiro banking malware operation using partner-provided data to identify operators and infrastructure.
On January 30, Brazilian Federal Police launched Operation Grandoreiro, carried out 13 search-and-seizure actions across multiple states, and announced five arrests tied to the malware's infrastructure.
In August 2022, a Zscaler report described a Grandoreiro campaign aimed at high-value company employees in Spain and Mexico.
On April 28, 2020, ESET documented Grandoreiro's spam-based delivery, modular banking malware architecture, DGA-based command-and-control, persistence, and evasion techniques.
Brazilian police said the criminal structure behind Grandoreiro is suspected of moving at least €3.6 million through fraud since 2019.
Grandoreiro has been active since at least 2017, targeting victims in countries including Brazil, Mexico, Spain, and Peru through banking fraud campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcewelivesecurity.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026
Spanish authorities arrested 16 people in **Operation Aguas Vivas** for allegedly laundering funds stolen through the **Mekotio** and **Grandoreiro** banking trojans, seizing devices and dismantling a four-tier criminal structure used to receive fraudulent transfers, redistribute money, move funds abroad, and conceal account activity. Investigators said the group obtained more than **€276,470** from compromised accounts and had access to roughly **€3.5 million** more that had not yet been transferred, underscoring how Brazilian banking malware operations had established a significant foothold in Spain. Security researchers reported that the malware activity continued and evolved despite the arrests, with **Mekotio** returning in phishing campaigns that used Spanish-language lures, ZIP archives, obfuscated batch files, fileless PowerShell, and **AutoHotkey** or **AutoIt**-based execution to evade detection and launch the final payload. ESET and Check Point said Latin American banking trojans remain heavily spam-driven, rely on victims interacting with fake banking overlays to steal credentials, and are expanding beyond Brazil into **Spain, Mexico, Portugal, Peru, and other parts of Europe**, with **Grandoreiro**, **Mekotio**, and related families such as **Casbaneiro** showing continued operational growth rather than major changes to core fraud techniques.
Aug 15, 2026
Kaspersky reported that the **Grandoreiro** banking trojan has continued operating globally despite law-enforcement disruptions and arrests, expanding from targeting about **900 banks in 40 countries** in 2023 to roughly **1,700 banks and 276 crypto wallets across 45 countries and territories** in 2024. Telemetry recorded more than **150,000 blocked infection attempts** affecting over **30,000 users** worldwide between January and October 2024, underscoring the malware’s sustained scale and resilience. Recent Grandoreiro campaigns used phishing emails, malvertising, **MSI-based loaders**, **DLL sideloading**, oversized padded binaries, and **CAPTCHA-based sandbox evasion** to infect victims. Kaspersky said newer versions also introduced fragmented codebases, stronger encryption, three domain generation algorithms for command-and-control, and mouse-behavior tracking to evade fraud detection, while preserving core capabilities including remote machine control, credential theft, one-time-password harvesting through overlays, clipboard replacement for cryptocurrency theft, and fraudulent banking transactions; some legacy variants are now concentrating on targets in Mexico.
Jun 29, 2026