Grandoreiro: A Local-Language Lure That Hides a Banking Trojan in a ZIP

A Grandoreiro banking trojan campaign sends users in at least five Latin American countries a local-language lure with a link, and the link leads through gated redirects to a decoy-padded ZIP whose script rebuilds a loader that fetches the trojan.

Grandoreiro is a banking trojan written in Delphi and sold as a service, first observed in 2016 according to MITRE ATT&CK. A domain generation algorithm (DGA) is a routine that computes a list of command server names from a seed, here the current date, so the operators can move without updating the malware.

Analysis based on Arctic Wolf Labs research dated 3 November 2026. The same family hit Mexico, Spain, Peru and Argentina in earlier 2026 telemetry that Infosecurity Magazine reported. Threat Watch has also covered another Latin American lure, a court-notice phishing page that builds its own ZIP.

How does the Grandoreiro phishing chain deliver the banking trojan?

Arctic Wolf describes one path from the email to the command server. Steps 1 to 4 are the lure and the redirects; steps 5 to 7 are the archive, the loader and the payload.

1. A user receives an email in the language of the target country, with an invoice, administrative, tax or legal theme. The lures are mostly Spanish, and some are Portuguese even when the target country is Spanish-speaking.
2. The email links to a short URL that starts with share.google. Arctic Wolf reports this link starts the infection chain.
3. The first page detects the visitor's language, shows matching instructions and tells mobile visitors the content is desktop-only. It forwards to a second domain that repeats the same checks.
4. The next stage imitates a SharePoint document-sharing portal in the visitor's language; some variants use a DocuSign theme. The final redirect applies access and download-limit checks, then serves a MediaFire-hosted payload.
5. The ZIP holds a deeply nested folder tree with two legitimate PE files and two benign PDFs as decoys. A VBScript in the root of the archive is the real payload; it carries junk code and several layers of obfuscation, then rebuilds and launches a Delphi loader.
6. The loader presents itself as a PDF reader and is inflated to about 80 MB by a large image. It resolves a daily rotating No-IP-hosted name through DNS over HTTPS to Google, derives a port from the resolved IP address, and asks for configuration with a sample-specific key. The reply gives the payload URL, size and file name.
7. The payload arrives as a ZIP protected by a custom variant of RC4 with a hardcoded key, and unpacks to RalinkRendererLPLbCleanLive.exe. For command traffic the malware takes the date from public time services and uses it as the DGA seed.

What a defender sees at each stage

The table lists what each hop shows and why a check that looks at one signal passes it. It is AegisAI's reading of the reported chain.

The reported timeline

How do I detect Grandoreiro in DNS and endpoint logs?

Detect the behaviour of the chain, because the names and files change. Arctic Wolf's hunting guidance has three parts:

• wscript.exe or cscript.exe running Shell.Exec, together with VBS files that hold very large concatenated encrypted strings.
• DNS, firewall, download and EDR events for mediafire[.]com, No-IP names and other free third-level DNS services, plus HTTP requests with an unusually long query string and an equally long response.
• DNS over HTTPS requests to public resolvers such as dns.google, dns.nextdns.io and dns.alidns.com for random-looking names, especially from systems that do not normally use DoH.

Acronis describes a second signal from the earlier wave: a renamed copy of Duplicate Files Finder is a strong warning sign, because the loader hides the application window at launch. Acronis also reports that the loader waits for at least three minutes of system uptime and exits if it finds shortcuts for seven analysis or testing applications, which matters for any sandbox that detonates files on a fresh start.

What this means for a security team

This section is AegisAI's analysis. Any organization with staff or suppliers in Latin America receives invoices, tax notices and legal notices in Spanish or Portuguese as normal mail, so a lure in those languages has no obvious flaw to catch. Arctic Wolf also found support for English, French and Italian in the infrastructure and loader. The report names five countries as targets, and it does not say who received the emails.

Three questions settle the exposure: whether staff can open a VBScript file from an archive with the Windows script host, whether proxy and DNS logs show DNS over HTTPS from ordinary workstations, and whether banking and payment credentials can be reset quickly for a user who ran the loader.

Why standard controls miss it

This section is AegisAI's analysis. A reputation check looks at a link's domain and history. The first link is a Google-hosted short URL, and the domains behind it are new, so history gives no score. A scanner that follows the link has to pass checks on language and device and may meet a download limit. A scanner that samples a ZIP finds legitimate files first. A sandbox that waits for network traffic can be beaten by a loader that checks the system before it calls out, which Acronis reported for the earlier wave. The remaining signal is the message itself: a business request in the recipient's language that sends the reader to a document page and a ZIP. That request is visible when the email arrives.

How AegisAI protects against it

AegisAI has not observed this campaign. Arctic Wolf reports that the lure arrives as an email with a link, so the approach below is how AegisAI treats a lure of this shape when it arrives by email. It does not cover what happens on an endpoint after the script runs.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

See a gated-link lure like this investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Block or quarantine ZIP attachments and download links in unsolicited invoice, tax and legal mail where there is no business need, in every language the organization receives, and set the default handler for .vbs files on staff machines to a text editor.
• Open archives fully in analysis, down to every nested folder, and treat a script in the root of an archive that also holds decoy executables and PDFs as hostile.
• Add detections for wscript.exe or cscript.exe running Shell.Exec and for DNS over HTTPS lookups from workstations that do not normally use it, and review proxy logs for mediafire[.]com downloads of ZIP files.
• Brief finance, procurement and legal staff, including those in Latin American offices, that an invoice or notice that asks for a document download from a share page is a request to verify through a known contact.
• Where a user ran the loader, isolate the host, then reset banking and payment credentials and review the sessions of the accounts they give access to.

FAQ