Loading story…
Grandoreiro has resurfaced in a new campaign targeting Latin America, with Mexico accounting for about 40% of observed detections and additional activity seen in Spain, Peru, Argentina, plus smaller clusters in Europe and North America. Researchers said the banking trojan is being delivered through a DLL sideloading chain that abuses the legitimate Duplicate Files Finder application alongside a malicious mingwm10.dll, allowing the malware to launch while hiding the program interface to reduce user suspicion.
The malware uses a protected loader with extensive anti-analysis checks before reaching command-and-control infrastructure, including uptime validation, shortcut and process checks, VM artifact detection, geolocation filtering, and username or hostname screening. If a system passes those checks, Grandoreiro resolves its infrastructure through Google DNS-over-HTTPS and attempts to fetch a second-stage payload over TCP port 6432 using encrypted host-specific requests, underscoring how the operation has remained active and shifted toward stealthier, lower-volume tactics despite a major 2024 law-enforcement disruption.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Telemetry from the last 30 days of June showed Mexico as the largest source of detected Grandoreiro samples, accounting for 40% of observed detections. Additional detections were reported in Spain, Peru, and Argentina, with smaller clusters in Europe and North America.
The malicious mingwm10.dll used in the sideloading chain carried a PE compilation timestamp of 2026/05/01, indicating the malware component used in the campaign was built by that date.
In May 2026, Grandoreiro operators launched a renewed campaign abusing the legitimate Duplicate Files Finder application for DLL sideloading. The chain used a renamed executable with legitimate dependencies and a malicious mingwm10.dll to execute the malware.
A coordinated operation led by Brazil's Polícia Federal and coordinated through INTERPOL with Spanish authorities disrupted significant portions of Grandoreiro infrastructure. Later reporting said the action disrupted parts of the malware's infrastructure but did not eliminate the operation.
Grandoreiro, a Brazilian-origin Delphi banking trojan, had been operating across Latin America since at least 2016, historically targeting financial institutions and their customers through phishing and social engineering.
Acronis Threat Research Unit published research detailing that Grandoreiro checks for virtualization, sandbox artifacts, security tools, and system configuration details before contacting command-and-control infrastructure. The report added new technical insight into the malware's evasion behavior during the renewed 2026 campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcedarkreading.com
Open sourcescworld.com
Open sourceinfosecurity-magazine.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026
Kaspersky reported that the **Grandoreiro** banking trojan has continued operating globally despite law-enforcement disruptions and arrests, expanding from targeting about **900 banks in 40 countries** in 2023 to roughly **1,700 banks and 276 crypto wallets across 45 countries and territories** in 2024. Telemetry recorded more than **150,000 blocked infection attempts** affecting over **30,000 users** worldwide between January and October 2024, underscoring the malware’s sustained scale and resilience. Recent Grandoreiro campaigns used phishing emails, malvertising, **MSI-based loaders**, **DLL sideloading**, oversized padded binaries, and **CAPTCHA-based sandbox evasion** to infect victims. Kaspersky said newer versions also introduced fragmented codebases, stronger encryption, three domain generation algorithms for command-and-control, and mouse-behavior tracking to evade fraud detection, while preserving core capabilities including remote machine control, credential theft, one-time-password harvesting through overlays, clipboard replacement for cryptocurrency theft, and fraudulent banking transactions; some legacy variants are now concentrating on targets in Mexico.
Jun 29, 2026
The **Grandoreiro** banking trojan has re-emerged as a large-scale global threat, with researchers reporting phishing-driven campaigns that now target more than **1,500 banking applications and websites across 60+ countries**. IBM X-Force said recent activity has used emails impersonating government entities in **Mexico, Argentina, and South Africa**, while other reporting tied the lures to organizations such as Mexico’s **SAT** and **CFE** and South Africa’s **SARS**. The malware, long associated with Latin America, has expanded into Europe, Africa, and the Indonesia-Pacific region and has been linked to financial fraud affecting multiple sectors.
Aug 15, 2026