Banking Trojans Manic, Grandoreiro & ToxicPanda 2.0 Target Mobile and Desktop Users
Written by AI from the linked story. Not reviewed by an editor. How this works
A new wave of banking trojans — Manic (Android), Grandoreiro (Windows), and ToxicPanda 2.0 (Android) — are actively targeting financial users across multiple regions, including Ukraine, Latin America, and Europe. These malware families combine credential theft, spyware capabilities, and advanced anti-analysis techniques to evade detection and persist on compromised devices. ToxicPanda 2.0's distribution via AWS infrastructure highlights how threat actors are abusing legitimate cloud services to increase credibility and bypass blocklists. The longevity of Grandoreiro (active for over a decade) underscores the danger of unpatched or unmonitored legacy systems. Without proactive user education, robust mobile device management, and real-time behavioral monitoring, financial institutions and their customers remain highly exposed.
Tactical Insight
Immediate actions
- Enforce mobile device management (MDM) policies that restrict sideloading of apps from unofficial sources on all corporate and BYOD devices.
- Block or scrutinize outbound connections to newly registered or anomalous AWS endpoints using DNS filtering and threat intelligence feeds.
- Push emergency security advisories to customers warning them of fake banking apps and phishing campaigns tied to these trojans.
Long-term improvements
- Implement application allowlisting on Windows endpoints to prevent unauthorized executables like Grandoreiro from running.
- Require regular OS and application patching cycles to eliminate vulnerabilities exploited by long-lived malware families.
- Adopt a zero-trust architecture that enforces step-up authentication for high-value banking transactions, reducing the impact of credential theft.
Detection measures
- Deploy mobile threat defense (MTD) solutions capable of detecting Android banking trojan behaviors such as overlay attacks and accessibility service abuse.
- Enable behavioral analytics and SIEM correlation rules to flag unusual banking session activity, account takeover patterns, or anomalous API calls indicative of trojan activity.
- Monitor for abuse of cloud infrastructure (e.g., AWS) as malware distribution channels by integrating cloud provider threat feeds into your SOC workflows.