Loading story…
Researchers detailed two major Brazil-linked banking malware operations, Guildma and Astaroth, both built to steal credentials, monitor victims, and facilitate online banking fraud. Guildma, active since at least 2015, evolved from a Brazil-focused banking trojan into a broader modular threat targeting more than 130 banks and 75 additional web services worldwide, while still concentrating overwhelmingly on Brazilian users. Avast said it blocked more than 155,000 infection attempts affecting over 26,000 users in 2019, with more than 98% of targeted users located in Brazil.
The malware families rely on stealthy infection chains and abuse of legitimate Windows components to evade detection. Guildma commonly arrives through phishing emails carrying ZIP archives and malicious .LNK files, then uses WMIC, XSL, and JavaScript downloaders to retrieve Delphi-based modules from changing infrastructure such as GitHub and Google Storage. Its toolset includes RAT functions, keylogging, screenshot capture, credential theft, process injection, browser and banking application monitoring, spam delivery, and bundled password-recovery utilities. Reporting on Astaroth similarly described information-stealing malware that hijacks legitimate OS and antivirus processes to harvest passwords and personal data, underscoring the continued sophistication of Brazilian banking malware campaigns.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Between January and July 2019, Avast reported protecting more than 26,000 users from 155,000 Guildma infection attempts, with more than 98% of targeted users located in Brazil.
In May 2019, Guildma expanded from primarily Brazilian targeting to a broader international scope, ultimately targeting more than 130 banks and 75 additional web services worldwide.
At the end of April 2019, Guildma operators introduced an obfuscated LNK variant that in some cases pointed download URLs to the TOR network.
Since September 2018, researchers observed more than 4,800 unique malicious Guildma LNK samples containing 280 hard-coded domains, showing sustained phishing-based distribution activity.
Avast's analysis states that Guildma had been active since at least 2015 as a modular banking trojan and spyware family primarily targeting Brazilian users and services.
Guildma operators briefly hosted version 139 payloads on a GitHub account named winsvrx, which GitHub removed after it was reported. The operators then shifted hosting to Google Storage buckets including ultramaker and later bradok.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 144 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Guildma** banking trojan, also tracked as **Astaroth**, continued targeting users in **Brazil** through large phishing campaigns delivering ZIP archives with malicious `.LNK` files disguised as invoices, payment proofs, tax notices, and COVID-19-themed messages. The malware focused heavily on stealing banking credentials—particularly from Brazilian institutions such as **Banco do Brasil**—while also harvesting browser, email, e-commerce, and streaming credentials, capturing screenshots and keystrokes, and enabling remote-control functions. Telemetry cited one major wave reaching **up to 50,000 first-stage samples per day**, underscoring the scale of the operation in Latin America. Analysis showed a fast-evolving, multi-stage infection chain built for stealth and resilience. Guildma/Astaroth abused multiple Windows **LOLBins** including `bitsadmin.exe`, `regsvr32`, `wmic`, `rundll32`, `certutil`, `explorer.exe`, and Internet Explorer's `ExtExport.exe`, while newer variants also used the legacy `finger.exe` client over **TCP/79** to fetch commands and a signed Microsoft Silverlight binary, `coregen.exe`, for **Signed Binary Proxy Execution**. The malware employed anti-debugging, anti-VM, and locale checks to restrict execution largely to Portuguese-language and Brazil-based systems, stored or loaded modules through obfuscated JScript and alternate data streams, and retrieved encrypted command-and-control infrastructure from **YouTube channel descriptions** with fallback servers to maintain access if primary infrastructure was disrupted.
Sep 1, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026