Grandoreiro Hits Spain Again, BTMOB Spreads on Android in Brazil

Two banking trojan operations are running in parallel against finance customers in Spain, Portugal, Mexico, and Brazil, and the malware in play is familiar to anyone who has worked Latin American fraud cases. WatchGuard and ESET have separately tracked the activity: Grandoreiro is hitting Windows machines at companies in Iberia and Mexico, while BTMOB RAT is going after Android handsets in Brazil. Both campaigns are active now.

If you run a SOC for a regional bank or a payments processor in those markets, this one is yours to handle this week.

Grandoreiro is not new. It has been around since 2017 and Interpol publicly disrupted a chunk of its operator network in 2024. It came back. The current run, documented by WatchGuard's Threat Lab, leans on phishing emails impersonating tax authorities and courier services, with links that pull a loader from legitimate file-hosting platforms. Once on the box, the trojan watches for browser sessions tied to specific Spanish, Portuguese, and Mexican banks, then throws fake overlay windows to harvest credentials and second-factor codes in real time.

The Android side is messier. BTMOB RAT, profiled by ESET researchers, masquerades as cryptocurrency and streaming apps distributed through phishing pages that mimic the Google Play layout. Once installed, it abuses Android Accessibility Services to read screen contents, log keystrokes, and stream the device display back to the operator. That last bit matters. Live screen sharing means the criminal can sit alongside the victim during a banking session and approve transfers manually, defeating most behavioural-fraud models that look for automated input.

A quick note on detection: Grandoreiro's loaders this round are using AutoIt scripts and DLL sideloading against signed binaries, which means your EDR rules built around suspicious parent-child process trees are still your best shot. For BTMOB, the accessibility-abuse pattern is the tell.

Neither operation is novel. Both work.

Here is what to do today:

1. Block inbound mail with links to MediaFire, MEGA, and Bitbucket raw downloads at the gateway, or at minimum quarantine for review — these are the current Grandoreiro drop hosts.
2. Push an MDM policy that denies Accessibility Service permissions to any app not on your allow-list, and audit which apps already hold that permission on corporate Android fleets.
3. Hunt for AutoIt3.exe execution from user-writable paths (%APPDATA%, %TEMP%) in the last 30 days; that pattern is doing most of the Grandoreiro loading right now.
4. Brief your fraud team that overlay attacks and live screen-sharing sessions are in scope — step-up auth on transfers should require an out-of-band channel, not an on-device prompt.
5. Share IOCs with your regional FS-ISAC chapter; both campaigns are spreading laterally across institutional victim lists.

Fraud teams in São Paulo and Madrid are already busy. Yours might be next.