Grandoreiro banking malware disrupted – Week in security with Tony Anscombe

Law enforcement in Brazil, assisted by ESET, Interpol, the Spanish Police and Caixa Bank, disrupted the Grandoreiro banking trojan infrastructure. Grandoreiro — active since at least 2017 across Brazil, Mexico, Spain and Argentina — used screen blocking, keystroke logging, simulated mouse/keyboard activity and fake pop-ups to commit banking fraud, causing millions in losses; ESET provided technical analysis and known C&C domains and IP addresses.