Grandoreiro Malware: An Evolving Threat to Banking Customers

Introduction to Grandoreiro Malware

Grandoreiro is a malware family classified as a backdoor and spyware, first seen in April 2020, and is consistently described as a banking trojan focused on credential theft, remote fraud enablement, and control of compromised Windows systems. It has remained active through recurring campaigns, including a renewed wave in May and June 2026 that concentrated heavily on Latin America, especially Mexico, while also reaching parts of Europe and North America. Its blend of banking fraud objectives, anti-analysis tradecraft, and continued operational recovery after disruption makes it a persistent financial threat.

Delivery Methods of Grandoreiro Malware

Grandoreiro is primarily delivered through phishing and spam campaigns that use socially engineered lures such as fake updates, document-themed messages, and banking-themed content to drive execution.

• Phishing emails and spam: Campaigns used phishing, malspam, and spearphishing links, including fake Java or Flash updates, COVID-19 lures, and document or invoice-themed messages.
• Archived payloads and attachments: Operators distributed ZIP archives and other compressed files, sometimes with VBS or embedded downloader components, including generic “Documenti” themed campaigns observed in Italy.
• DLL sideloading with legitimate software: Recent campaigns abused the Duplicate Files Finder application and a malicious mingwm10.dll to execute the malware through DLL sideloading.
• Cloud and public hosting services: Delivery chains used abused cloud platforms and public file-sharing or hosting services including GitHub, Dropbox, Pastebin, 4shared, 4Sync, Azure, and Dropbox to stage or serve payloads.

TTPs and Technical Behavior of Grandoreiro Malware

After execution, Grandoreiro emphasizes stealth, host validation, and operator-controlled fraud functions while maintaining communication with attacker infrastructure.

• Defense evasion and anti-analysis (T1497/T1497.001): It performs sandbox, virtual machine, and process-based checks, profiles the host environment, uses string obfuscation, hides windows, and blacklists certain countries before contacting C2.
• Persistence and execution control (T1547.001/T1547.009/T1574.002): Grandoreiro persists after reboot, has used startup shortcuts and run keys, and in newer campaigns runs through DLL sideloading chains that abuse legitimate executables.
• Credential and data theft (T1056/T1056.001/T1555.003): The malware captures keystrokes, steals browser-stored credentials and authentication material, collects system and user information, and in some variants extracts Outlook data, cookies, and clipboard content.
• Command and control and staged payloading (T1071.001/T1568.002/T1105): It communicates with C2 over web protocols, uses DGA-based resolution and Google-hosted paths in some variants, and can retrieve second-stage payloads or additional components after initial host checks.

Impact of Grandoreiro Malware

Grandoreiro’s primary impact is financial fraud through stolen banking credentials, session access, and real-time manipulation of victim banking activity. Successful infection can enable unauthorized account access, fraudulent transfers, and continued compromise of financial users and institutions across multiple regions. Its ability to evade analysis and re-emerge after disruption increases defender burden and prolongs exposure for targeted banking ecosystems.

Threat Actors, Campaigns and Market Presence of Grandoreiro Malware

Grandoreiro is linked to the Tetrade group, which uses the malware in ongoing banking operations focused on credential theft and fraudulent transactions across Brazil, Spain, Mexico, and Portugal. The malware is also associated with the May to June 2026 Grandoreiro Latin America Banking Trojan Resurgence campaign targeting consumer banking users, with Mexico as the most affected area. Multiple reports describe Grandoreiro operating under a Malware-as-a-Service model, with creators renting it to other cybercriminals and sustaining activity despite law-enforcement disruption in January 2024.

Malware Ecosystem and Lineage of Grandoreiro Malware

Grandoreiro is described as part of the Brazilian banking malware cluster known as the Tetrade, alongside Guildma, Javali, and Melcoz. It also shares a string decryption algorithm with Casbaneiro, reflecting overlap or information sharing among Latin American banking trojan developers. Within infection chains, it operates as a staged banking malware platform that can use loaders, sideloading chains, and second-stage retrieval to separate delivery from full fraud capability.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

Grandoreiro Malware TTPs (Sample of 50)

Grandoreiro Malware IOCs (Sample of 50)