# Grandoreiro and BTMOB: Banking Trojans Expand Attacks Across Windows and Android in Latin America
Banking trojans continue their relentless evolution, with fresh campaigns targeting financial institutions and their customers across Latin America and Europe. New research from cybersecurity firms WatchGuard and ESET reveals that two distinct malware families—Grandoreiro on Windows and BTMOB on Android—are orchestrating coordinated attacks that underscore how financially motivated threat actors are becoming increasingly sophisticated in their evasion tactics and platform coverage.
## The Threat
Financial institutions and their customers across Spain, Portugal, Mexico, and Brazil face renewed targeting from two formidable banking malware families. Grandoreiro, active since 2016, has evolved into one of the most dangerous banking trojans in circulation, with the capability to steal credentials associated with thousands of financial institutions spanning 45 countries and territories. Meanwhile, BTMOB, an Android remote access trojan (RAT) that first emerged in February 2025, provides threat actors with granular control over mobile devices—from unlocking screens to capturing screenshots and automating credential theft.
The dual-platform approach is deliberate. By targeting both desktop and mobile users, attackers maximize their reach across the digital banking ecosystem where victims increasingly split their financial transactions between devices.
## Background and Context
Grandoreiro's Evolution
Grandoreiro has maintained an active presence in the threat landscape for a decade, surviving law enforcement actions and infrastructure dismantling attempts. In early 2024, Brazilian authorities made significant headway, including arrests targeting the malware's operational infrastructure. Yet Grandoreiro persisted, not through a resurrection, but through continuous adaptation.
The malware typically arrives via phishing emails containing malicious links. Recipients are typically tricked into downloading and executing files that trigger a cascade of infections. Over the years, Grandoreiro has incorporated increasingly sophisticated defenses—including CAPTCHA checks designed to frustrate automated analysis and sandbox detection systems—making manual reverse engineering a necessary but time-consuming requirement for security researchers.
BTMOB's Market Entry
BTMOB represents a newer threat vector. Since its emergence early this year, the Android RAT has demonstrated capabilities that rival premium commercial mobile device management tools, but deployed for criminal purposes. The trojan's feature set includes device unlock functionality, screenshot capture, keystroke logging, and HTML injection capabilities that auto-fill credentials when users launch banking applications.
## Technical Details
### Grandoreiro's DLL Side-Loading Strategy
The latest Grandoreiro campaign leverages DLL side-loading, a technique that exploits legitimate application workflows to load malicious libraries. WatchGuard researchers identified the attack chain targeting Portuguese financial institutions, with four distinct software packages being abused to sideload trojanized DLLs.
The malware operators used Delphi 11, a programming language favored for malware development in Latin America, to compile the malicious DLLs:
These libraries establish peer-to-peer communications using STUN (Session Traversal Utilities for NAT) and ICE protocols. The technical choice is purposeful: WebRTC traffic is inherently "noisy," difficult to monitor, and ubiquitous on legitimate web conferencing platforms. This allows the malware to blend seamlessly into network traffic that many organizations already trust, making detection exponentially harder.
### Targeted Financial Institutions
Hardcoded references within the DLLs reveal specific targeting:
| Institution | Region |
|------------|--------|
| Abanca | Portugal |
| Banco de Portugal | Portugal |
| BBVA PT | Portugal |
| Caixa Geral Depositos | Portugal |
| Santander | Portugal |
| Revolut | Multi-region |
| Wise | Multi-region |
### Secondary Distribution Chain
A parallel Grandoreiro campaign distributes payloads via phishing emails containing ZIP archives hosted on MediaFire. The archive contains an obfuscated Visual Basic Script that:
1. Executes an initial executable displaying a fake Adobe Reader update prompt
2. Performs multiple anti-analysis checks to detect sandbox environments
3. Launches the final banking trojan payload
### BTMOB Capabilities and Distribution
BTMOB provides threat actors with an exceptional toolkit for financial fraud at scale:
## Implications and Risk Assessment
Widespread Exposure
The geographic targeting—encompassing all of Latin America and portions of Europe—suggests threat actors have compartmentalized operations across regions, each optimized for local banking infrastructure and language preferences. This operational discipline indicates a well-resourced, organized group with sustained funding.
Institutional Vulnerability
Banks and fintech companies face a two-vector attack. Desktop security defenses alone cannot stop Grandoreiro if users conduct banking on mobile devices, and vice versa. Financial institutions relying solely on traditional endpoint detection and response (EDR) solutions are partially blind to the full attack surface.
Customer Risk
For consumers, the threat is acute. Phishing emails remain the primary infection vector, and even security-conscious users can be compromised through sophisticated social engineering paired with convincing fake update prompts.
## Recommendations
For Financial Institutions:
For Enterprises and Consumers:
---
## HackWire Analysis
Why This Matters Now: The Blending Problem
The Grandoreiro and BTMOB campaigns underscore a critical shift in the threat landscape: financially motivated actors have solved the *visibility problem*. Traditional defenses look for malware behaving badly—suspicious network connections, unsigned executables, anomalous process trees. Grandoreiro's use of WebRTC traffic and legitimate library injection defeats these heuristics by design.
What's particularly alarming is the platform parallelism. Rather than forcing customers toward a single secure device type, banks now defend against trojans that seamlessly span Windows desktops, Android phones, and web-based banking portals. A victim compromised on their laptop faces equal risk on their phone if the same credentials are reused. This isn't a technical oversight—it's a structural feature of modern financial systems that criminals actively exploit.
The pattern also echoes a broader trend: law enforcement action has a half-life. Brazilian authorities disrupted Grandoreiro's infrastructure in early 2024. Today, the malware is more active than ever, suggesting that dismantling physical infrastructure is insufficient when operational knowledge—techniques, targeting lists, phishing templates—remains intact. Grandoreiro likely operates as a distributed franchise of affiliate operators, each running campaigns independently.
Finally, BTMOB's packaging as a ready-made campaign tool signals democratization of financial malware. The days of elite malware families operated by a handful of groups are ending. What we're seeing instead is commoditized malware sold to mid-tier threat actors, expanding the attacker pool exponentially while maintaining sophistication.
Defenders should treat this as a long-term siege, not a discrete threat to patch and move on. The actors behind these campaigns are profitable, patient, and evolving faster than defense budgets can typically scale to match.
— HackWire Editorial
---
## Related Coverage