Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
New and updated banking trojans Manic, Grandoreiro, and ToxicPanda 2.0 are targeting users globally.
Cybersecurity firms have detailed new and updated banking trojans: Manic, an Android malware with spyware capabilities targeting Ukraine and other regions; Grandoreiro, a decade-old Windows trojan focusing on Latin America and Europe with advanced anti-analysis features; and ToxicPanda 2.0, an Android banking trojan with expanded command support and targets, now distributed via AWS.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Duplicate Files Finder (DFF)?
Get an email when a new story names Duplicate Files Finder (DFF), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA new wave of banking trojans — Manic (Android), Grandoreiro (Windows), and ToxicPanda 2.0 (Android) — are actively targeting financial users across multiple regions, including Ukraine, Latin America, and Europe. These malware families combine credential theft, spyware capabilities, and advanced anti-analysis techniques to evade detection and persist on compromised devices. ToxicPanda 2.0's distribution via AWS infrastructure highlights how threat actors are abusing legitimate cloud services to increase credibility and bypass blocklists. The longevity of Grandoreiro (active for over a decade) underscores the danger of unpatched or unmonitored legacy systems. Without proactive user education, robust mobile device management, and real-time behavioral monitoring, financial institutions and their customers remain highly exposed.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Manic
- malware — Grandoreiro
- malware — ToxicPanda 2.0