Grandoreiro: The Banking Trojan That Refuses to Die

What started as a regional Brazilian banking fraud tool in 2016 has grown into one of the most persistent financial malware operations on the planet. Law enforcement arrested its operators, dismantled its infrastructure, and declared victory. The malware came back stronger.

Most malware families have a natural lifespan. They emerge, spread, get detected, and eventually fade as defenders adapt. Grandoreiro has spent nearly a decade defying this pattern. Originating in Brazil, it quietly expanded across Latin America, crossed the Atlantic to Spain and Portugal, pushed into Africa, and as of 2025 is actively targeting banks in Japan, Italy, the Netherlands, and South Africa. Despite international arrests in 2021 and 2024 and the involvement of INTERPOL, ESET, and Group-IB in attempted takedowns, portions of the operation remain live, actively developed, and apparently available to other criminals on a subscription basis.

What makes Grandoreiro particularly unsettling is not just its reach but its approach. This is not malware that simply steals a password and disappears. It sits invisibly inside a victim’s machine, waits for them to log into online banking, and then either injects fraudulent overlays, manipulates the transaction in real time, or hands remote control of the session to a human operator on the other end. By the time anyone notices something is wrong, the money is already gone.

From Brazil to Everywhere: How the Expansion Happened

Grandoreiro belongs to a cluster of Brazilian banking trojans researchers call the Tetrade, alongside Mekotio, Guildma, and Javali. When it first appeared around 2016, it focused almost entirely on Brazilian banking customers and later expanded to Spanish-speaking markets in Mexico, Argentina, Peru, Chile, and Spain. The code was written in Delphi, the operators spoke Portuguese, and the phishing emails targeted Spanish-language recipients. It felt geographically bounded.

That changed rapidly. IBM X-Force researchers tracking post-2024 campaigns found the malware targeting over 1,500 banking applications and websites across more than 60 countries, with the most recent variants adding Asia and the Pacific to the list. By late 2024, the target list had grown to 1,700 banks and 276 cryptocurrency wallets. The operators had essentially rebuilt the malware from scratch in one branch, creating what ESET researchers dubbed NewGrandoreiro after the January 2024 law enforcement action, while other operators using older infrastructure simply kept running.

Named Targets: Banks, Institutions, and Organizations in the Crosshairs

Unlike many threat intelligence reports that describe targets only in aggregate terms, researchers have documented specific institutions hardcoded into Grandoreiro’s targeting lists or impersonated in its phishing campaigns.

Financial institutions directly targeted or impersonated

How the Attack Actually Works

Every Grandoreiro infection begins with a phishing email, and the operators put real effort into making those emails convincing. Rather than sending generic messages, campaigns are localized for each target region with the right language, the right sender impersonation, and lures matched to what people in that country would plausibly receive.

Common lures have included fake court subpoenas, unpaid tax notifications, mortgage cancellation documents, shipping alerts, telecom bills, and banking security warnings. One documented campaign impersonated the Mexican Attorney General’s Office, sending fake legal notifications with malicious download links. Another used forged mortgage cancellation forms to pressure victims into opening attachments urgently. The more recently observed campaigns impersonating Mexico’s SAT tax authority and Argentina’s AFIP revenue service used legitimate hosting providers like Contabo and cloud platforms including Google Cloud, Microsoft Azure, and Amazon to make the traffic blend in with everyday web activity.

What the Malware Can Do Once It’s Inside

Modern Grandoreiro variants are not simple password stealers. They function as a full remote banking intrusion platform, giving operators the ability to see and interact with everything the victim does in real time. The capability list documented across research from Kaspersky, IBM, and Zscaler is extensive.

The most dangerous capability is session hijacking during a live banking session. Rather than stealing credentials and logging in separately (which would trigger fraud alerts because the location and device would be unfamiliar), Grandoreiro waits until the victim logs in from their own device, then either injects a fake overlay prompting the victim to enter additional information, manipulates the transaction in progress, or hands full remote control of the session to an operator. Since the activity originates from the victim’s legitimate device, bank fraud detection systems that flag unusual locations or new devices often miss it entirely.

The Outlook Trick: Turning Your Own Email Against You

One of the more alarming capabilities identified by IBM X-Force researchers in newer variants is the malware’s ability to use an infected machine’s Microsoft Outlook client to send additional phishing emails automatically. This is not Grandoreiro sending spam through its own servers. It is hijacking the victim’s actual corporate email account and sending phishing messages that appear to come from a legitimate employee at a real company.

The practical consequence is significant. A finance employee at a manufacturing firm gets infected. Their Outlook client is weaponized. Their colleagues, suppliers, and customers start receiving what appears to be a genuine email from a known contact, asking them to review an invoice or a document. The email passes SPF and DKIM checks because it is actually coming from the legitimate account on the legitimate mail server. The click-through rate on these messages is dramatically higher than on cold phishing emails, and the infection can spread through an entire organization’s supply chain this way.

“By using the local Outlook client for spamming, Grandoreiro can spread through infected victim inboxes via email, which likely contributes to the large amount of spam volume observed.” IBM X-Force, 2024

Built to Evade: Why Detection Is So Difficult

Grandoreiro’s operators have invested substantial effort in making their malware hard to find, hard to analyze, and hard to attribute. Several of the documented evasion techniques are worth understanding in detail because they explain why standard security tools often miss it.

The file size inflation trick is both simple and effective. By embedding large BMP image resources into the binary, researchers found variants exceeding 400 MB. Many automated sandbox systems and email security gateways skip files above a certain size threshold for performance reasons. The malware exploits this cutoff deliberately.

The VMware detection check is more technically sophisticated. The malware queries specific VMware I/O ports during startup. If it receives a response that indicates it is running inside a virtual machine (as most malware analysis sandboxes are), it terminates without executing the malicious payload. The analyst sees the binary run briefly and exit cleanly, and marks it as benign.

The domain generation algorithm means there is no fixed command-and-control address to block. Each variant generates a rotating list of domain names based on a mathematical formula seeded with the current date. Defenders cannot simply add a known IP or domain to a blocklist and consider the threat addressed. The infrastructure shifts constantly. Recent campaigns have also hidden malicious traffic inside legitimate cloud service connections on Google Cloud, Microsoft Azure, and Amazon Web Services, making it blend into normal enterprise web traffic.

Law Enforcement Operations: Arrests That Did Not Stop the Malware

Grandoreiro has been targeted by law enforcement multiple times, which is itself a testament to how significant the threat became. The timeline of enforcement actions tells a story of partial successes that failed to end the operation.

Why It Keeps Growing: The Malware-as-a-Service Factor

One reason law enforcement action has not killed Grandoreiro is that the malware appears to operate as a service rather than as a single criminal group. IBM X-Force and other researchers describe it as a probable Malware-as-a-Service ecosystem where the core infrastructure, phishing templates, loaders, and banking modules are leased to other criminal operators who conduct their own campaigns.

This structure means that arresting a programmer or administrator disrupts one node of the network but leaves other subscribers operating independently. The original developers may still be providing ongoing updates to paying customers even while under investigation. The NewGrandoreiro variant identified by ESET appears to be a separate fork with a different development team, suggesting the codebase has effectively split into at least two parallel lineages.

For financially motivated criminals with limited technical skills, Grandoreiro’s infrastructure represents a turnkey fraud operation. The phishing templates are localized and ready to send. The payload handles detection evasion automatically. The banking overlays are pre-built for hundreds of target institutions. The only thing a subscriber needs to provide is a distribution list and money mules to receive and move the stolen funds.

What Defenders Can Actually Do About It

Because Grandoreiro uses techniques specifically designed to bypass signature-based detection, the defensive response needs to be equally layered. Several approaches are particularly effective given what is documented about how the malware operates.

References

This article is provided for informational and educational purposes. Named financial institutions appear because they have been specifically cited in published threat intelligence research as targets or because they were named in law enforcement actions. Their inclusion does not imply any security deficiency on their part. Grandoreiro targets institutions because of their size and customer base, not because of any weakness in their security posture.