Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide

A revived Grandoreiro banking-trojan campaign has been active globally since March 2024, using large-scale phishing to deliver a padded loader and the banking trojan to targets across 60+ countries and 1,500+ banks; the malware includes a reworked DGA, improved string decryption, geolocation checks to avoid certain countries, and a new Outlook-based spamming module to propagate via infected mailboxes, and researchers also observed a substantially rewritten fork dubbed "NewGrandoreiro."