Grandoreiro Malware Campaign Targets Europe and Latin America

Grandoreiro banking-trojan campaigns continue to actively target banks and financial services in Portugal, Spain, Mexico and Latin America using phishing to deliver DLL side-loading loaders (libwebp.dll, mingw10.dll, libffi-6.dll, libpng15.dll) and obfuscated VBS droppers; the malware leverages WebRTC/STUN/ICE, cloud services (Google Cloud, Azure, AWS, Binance API), anti-debugging and geofencing to evade detection while abusing legitimate hosting and file-sharing platforms.