Grandoreiro Banking Trojan Resurfaces in Mexico Campaign

Mexico currently accounts for 40% of all detected Grandoreiro banking trojan activity, marking a significant resurgence for the malware despite a major international law enforcement disruption in January 2024 [1]. The campaign, which relies on sophisticated DLL sideloading to bypass security, poses a persistent threat to financial institutions and their customers across Latin America and beyond [3].

Evolving Tactics and Distribution

The latest campaign, observed by researchers in May 2026, utilizes a legitimate file-management tool, Duplicate Files Finder, to execute malicious code [1]. By renaming the application and placing a malicious library alongside it, attackers successfully employ DLL sideloading to trigger the trojan while appearing as a trusted process [3]. This method is paired with extensive anti-analysis features, including checks for virtualization, sandbox environments, and nearly 50 distinct security or monitoring tools, which the malware scans for before establishing contact with its command-and-control infrastructure [1].

While the malware's overall activity remains below its historical peak, the current campaign demonstrates a shift toward more stealthy, modular deployment [1]. Researchers note that the operators have moved away from simple distribution, instead using invoice-themed ZIP files to trick users into installing the payload [3]. This strategy follows a broader trend of "malware-as-a-service" operations, which have allowed the trojan to persist by fragmenting its codebase into smaller, more difficult-to-detect versions [3].

Global Reach and Financial Impact

Although the malware originated in Brazil and remains heavily concentrated in Spanish-speaking regions, its reach has expanded significantly since its 2016 inception [3]. Recent telemetry shows that while Mexico leads with 40% of detections, Spain follows at 17%, Peru at 13%, and Argentina at 10% [1]. The trojan is designed to steal banking credentials through keystroke logging, screen sharing, and remote device control, targeting more than 1,500 banks across over 60 countries [2].

The persistence of the threat suggests that the 2024 law enforcement operation, which resulted in the arrest of five administrators, did not fully dismantle the underlying infrastructure [3]. Instead, the operators have adapted by impersonating various government entities, including tax and finance authorities in Mexico, Argentina, and South Africa, to increase the effectiveness of their phishing campaigns [2].

What to watch

• Geographic Spread: Monitor whether detection clusters expand beyond the current focus on Latin America and Spain into other regions, as seen in recent South African campaigns [2].
• Infrastructure Evolution: Watch for further updates to the "light" version of the malware, which researchers suggest is being used to maintain operations despite ongoing international takedown efforts [4].
• Delivery Vectors: Observe if attackers move beyond invoice-themed spam to new social engineering tactics as security providers update their detection signatures for the current DLL sideloading chain [3].

The ability of the Grandoreiro operation to reorganize after high-profile arrests highlights the resilience of modern, decentralized cybercrime networks. Whether this latest campaign represents a permanent shift in strategy or a temporary surge remains an open question for financial security teams.