Loading story…
ESET reported that several major Latin American banking trojan families—including Amavaldo, Casbaneiro, Mispadu, Guildma, Grandoreiro, and Mekotio—are distinct malware operations that nonetheless share extensive code, delivery logic, and operational techniques. Researchers said the overlap spans uncommon libraries, obfuscation methods, domain generation algorithms, string-encryption routines, and near-identical banking-trojan behavior, indicating close cooperation among financially motivated threat actors rather than coincidence.
The campaigns commonly use spearphishing attachments and links to deliver payloads, often through ZIP archives, malicious documents, and MSI installers, with Visual Basic–based scripts and macros used for execution and staging. Once launched, the malware typically establishes persistence through Registry Run keys or Startup folders, uses DLL side-loading, and steals banking credentials through fake pop-up windows, keylogging, screenshots, and security-software discovery; ESET also noted that several of these families expanded beyond Latin America to target victims in Spain and Portugal.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ESET published a white paper and accompanying analysis concluding that Latin American banking trojans are multiple distinct malware families that share code, delivery logic, and techniques extensively enough to indicate close cooperation among multiple threat actors.
ESET observed that since late 2019, several Latin American banking trojan families expanded beyond their usual Latin American targets to also target victims in Spain and Portugal.
ESET reported that since 2019, the vast majority of several Latin American banking trojan families have used Windows Installer MSI files as the first stage of their distribution chains.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET detailed the **Vadokrist** banking trojan as an actively developed malware family focused almost exclusively on Brazil, with tracking dating back to 2018. Written in Delphi, the malware includes backdoor capabilities commonly used in banking fraud, including mouse and keyboard control, keylogging, screenshots, and browser disruption. Researchers said Vadokrist also contains substantial unused code that appears intended to complicate analysis, and it relies on encrypted remote configuration files—often hosted on public storage services—to obtain command-and-control information and downloader instructions. Recent campaigns distributed Vadokrist through spam emails carrying nested ZIP archives that ultimately delivered MSI and CAB files, followed by JavaScript-based persistence and direct installation of the trojan without a separate downloader in that infection chain. ESET said the malware uses a custom **"TripleKey"** cryptographic scheme also seen in other Latin American banking trojans, with occasional use of `RC4` and historical use of `TwoFish`, and noted infrastructure and development similarities with **Amavaldo, Casbaneiro, Grandoreiro, and Mekotio**, indicating shared tradecraft across the regional banking-malware ecosystem.
Aug 14, 2026
Spanish authorities arrested 16 people in **Operation Aguas Vivas** for allegedly laundering funds stolen through the **Mekotio** and **Grandoreiro** banking trojans, seizing devices and dismantling a four-tier criminal structure used to receive fraudulent transfers, redistribute money, move funds abroad, and conceal account activity. Investigators said the group obtained more than **€276,470** from compromised accounts and had access to roughly **€3.5 million** more that had not yet been transferred, underscoring how Brazilian banking malware operations had established a significant foothold in Spain. Security researchers reported that the malware activity continued and evolved despite the arrests, with **Mekotio** returning in phishing campaigns that used Spanish-language lures, ZIP archives, obfuscated batch files, fileless PowerShell, and **AutoHotkey** or **AutoIt**-based execution to evade detection and launch the final payload. ESET and Check Point said Latin American banking trojans remain heavily spam-driven, rely on victims interacting with fake banking overlays to steal credentials, and are expanding beyond Brazil into **Spain, Mexico, Portugal, Peru, and other parts of Europe**, with **Grandoreiro**, **Mekotio**, and related families such as **Casbaneiro** showing continued operational growth rather than major changes to core fraud techniques.
Aug 15, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026