Infosecurity Magazine reports that the Grandoreiro banking trojan has resurfaced in a new campaign primarily targeting Latin American users, with Mexico being the most affected country. Despite a significant law enforcement operation in January 2024 that disrupted its infrastructure, the malware, originating from Brazil, continues to pose a threat, according to new research from Acronis’ Threat Research Unit.The latest campaign, observed in May 2026, utilizes DLL sideloading to execute the banking trojan. Attackers disguise the malware by renaming a legitimate application, Duplicate Files Finder, and placing a malicious mingwm10.dll file alongside its legitimate dependencies. This causes the trusted executable to load the malicious library. The malware employs extensive anti-analysis checks, looking for virtualization, sandbox artifacts, security tools, and specific system configurations before contacting its command-and-control (C2) infrastructure.Telemetry from June shows Mexico accounting for 40% of detections, followed by Spain (17%), Peru (13%), and Argentina (10%). While overall activity is below previous peaks, the continued evolution of Grandoreiro indicates the malware operation has not been eliminated.Source: Infosecurity Magazine
