Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign

Banking trojan Grandoreiro resurfaces in Mexico using DLL sideloading, now accounting for 40% of detections after its 2024 disruption.

Grandoreiro, a banking trojan disrupted in 2024, is active again with a new DLL sideloading technique. Mexico now accounts for 40% of the malware's detections. The resurgence signals renewed targeting of banking customers in Latin America.

• Grandoreiro banking trojan resurged after its 2024 disruption
• New campaign uses DLL sideloading to execute malware
• Mexico now accounts for 40% of Grandoreiro detections
• Renewed focus on banking customers in Latin America