Banking malware Grandoreiro returns after police disruption

**Grandoreiro banking trojan resurfaces as a strengthened, MaaS-driven global phishing campaign** — After a January 2024 takedown effort, Grandoreiro has reportedly returned to large-scale operations since March 2024, targeting customers of roughly 1,500 banks across 60+ countries; the updated malware includes improved string decryption, a multi-seed domain generation algorithm, Outlook abuse to spread phishing, new persistence via Run registry keys, expanded command-and-control capabilities (remote control, file upload/download, keylogging, browser manipulation), and victim profiling to evade execution in certain countries and configurations.