[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ff_2o-O8_56DUXLMlkQZ7gHc-pZi2c4XuqHnjm0ic9bw":3},{"article":4,"iocs":40,"watch_terms":50,"solutions":51,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"30de7774-603e-4abc-a0c2-23f3d8ca7b6d","Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight","banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight-2e6889","The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware. The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek.","Cybersecurity firms have detailed new and updated banking trojans: Manic, an Android malware with spyware capabilities targeting Ukraine and other regions; Grandoreiro, a decade-old Windows trojan focusing on Latin America and Europe with advanced anti-analysis features; and ToxicPanda 2.0, an Android banking trojan with expanded command support and targets, now distributed via AWS.","New and updated banking trojans Manic, Grandoreiro, and ToxicPanda 2.0 are targeting users globally.","https:\u002F\u002Fwww.securityweek.com\u002Fbanking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002Fandroid-banking-malware.png","2026-08-22T08:30:00+00:00","2026-08-22T10:00:20.023034+00:00",8,[17,20,23,25],{"name":18,"type":19},"Duplicate Files Finder (DFF)","product",{"name":21,"type":22},"DLL sideloading","technology",{"name":24,"type":22},"Android Wireless Debugging (ADB)",{"name":26,"type":22},"AWS","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,35],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41,44,47],{"type":31,"value":42,"context":43},"Manic","Android malware combining banking trojan and spyware capabilities.",{"type":31,"value":45,"context":46},"Grandoreiro","Windows banking trojan active for a decade, focusing on Latin America and Europe.",{"type":31,"value":48,"context":49},"ToxicPanda 2.0","Updated Android banking trojan variant targeting financial institutions.",[18],{"controls":52,"vendors":139},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":39,"name":83,"problem":84,"products":85},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":111,"name":112,"problem":113,"products":114},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":157},"banking-trojans-manic-grandoreiro-toxicpanda-20-target-mobile-and-desktop-users","Banking Trojans Manic, Grandoreiro & ToxicPanda 2.0 Target Mobile and Desktop Users","A new wave of banking trojans — Manic (Android), Grandoreiro (Windows), and ToxicPanda 2.0 (Android) — are actively targeting financial users across multiple regions, including Ukraine, Latin America, and Europe. These malware families combine credential theft, spyware capabilities, and advanced anti-analysis techniques to evade detection and persist on compromised devices. ToxicPanda 2.0's distribution via AWS infrastructure highlights how threat actors are abusing legitimate cloud services to increase credibility and bypass blocklists. The longevity of Grandoreiro (active for over a decade) underscores the danger of unpatched or unmonitored legacy systems. Without proactive user education, robust mobile device management, and real-time behavioral monitoring, financial institutions and their customers remain highly exposed.",[145,146,147,148,149,150,151,152,153,154,155,156],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-124 – Guidelines for Managing the Security of Mobile Devices","GDPR Article 32 – Security of Processing (for EU-region financial data exposure)","PCI DSS Requirement 5 – Protect All Systems Against Malware","PCI DSS Requirement 6 – Develop and Maintain Secure Systems and Software","ITIL – Threat and Vulnerability Management Practice",{}]