Grandoreiro

Grandoreiro is a Delphi-based Brazilian banking trojan active since at least 2016 and widely associated with the Latin American banking malware cluster often referred to as the Tetrade. It is designed to facilitate fraudulent banking operations by abusing the victim’s own device and session, allowing operators to bypass institution-side security controls. Over time it expanded from Brazil and Mexico into Spain, Portugal, broader Europe, and other regions worldwide, with targeting reported against large numbers of banks and cryptocurrency wallet services across dozens of countries and territories.

Grandoreiro is primarily distributed through phishing campaigns, typically using tax, invoice, utility, document-sharing, or update-themed lures. Observed delivery chains include phishing emails containing links to ZIP archives, malicious attachments, MSI, HTA, EXE, and VBS-based loaders, as well as campaigns using malvertising. Multiple campaigns have used DLL sideloading with legitimate signed software to launch malicious Delphi DLL payloads. Operators have also used oversized padded binaries, CAPTCHA checks, geofencing, anti-debugging, virtualization checks, and security-product discovery to reduce analysis and detection.

Functionally, Grandoreiro is a full-featured banking trojan with remote-access capabilities. It can steal credentials through keylogging, screen capture, clipboard capture, and banking overlays shown when victims access targeted financial sites. It has been reported to support web injection, command execution, desktop window manipulation, simulated mouse or keyboard activity, self-updating, and operator-driven remote control of the victim machine during live banking sessions. Recent versions also include cryptocurrency-focused theft features such as clipboard replacement aimed at wallet redirection. The malware can enumerate installed security products and collect host profiling data including username, system configuration, language, time zone, browser and software presence, and geolocation.

Grandoreiro has been linked in reporting to threat clusters including TA2725 and to criminal operators targeted by international law-enforcement actions involving Brazil, Spain, Argentina, and INTERPOL. Those disruptions did not eliminate the threat, and subsequent reporting indicates continued development, fragmented code branches, evolving encryption, and dynamic command-and-control generation through DGA mechanisms. Grandoreiro remains one of the most significant banking malware families affecting Windows users, financial institutions, and banking customers in Latin America and Europe.