The 2026 Banking Threat Landscape - Analysing the Latest Grandoreiro and BTMOB Campaigns

The Dual-Front Threat

1. Grandoreiro Malware (Windows Targets)

Grandoreiro is a well-established "remote-overlay" banking Trojan that has been active since 2017. Its primary objective is to facilitate fraudulent bank transfers by hijacking a user's active online banking session.

• Mechanism - Upon infection, the malware monitors for specific banking websites. When a user visits one, it launches full-screen overlay images that mimic the bank's actual interface to trick the victim into providing credentials or keeping a session alive.
• Tactics - Recent reports indicate that the current campaign employs DLL side-loading to bypass security measures, specifically targeting financial institutions in Portugal. It is known for its modular design, which includes keylogging, backdoor capabilities, and the ability to steal cookies to bypass multi-factor authentication.

2. BTMOB RAT (Android Targets)

BTMOB is a sophisticated Remote Access Trojan (RAT) that evolved from an earlier malware family known as SpySolr. Unlike simple banking trojans, BTMOB is designed for full device takeover.

• Capabilities - Beyond stealing financial data, it can exfiltrate sensitive files, capture screenshots, record on-device activity, and provide operators with real-time remote control.
• Malware-as-a-Service (MaaS) - BTMOB is sold commercially as a product, complete with a "no-code" APK builder interface. This allows even low-skilled attackers to generate custom payloads and tailor phishing lures for specific regional targets without needing programming knowledge.
• Distribution - Attackers distribute BTMOB via social engineering, steering victims toward phishing sites, disguised as streaming services or crypto-mining platforms—that ultimately prompt the installation of malicious APKs. Once installed, it abuses Android’s Accessibility Services to grant itself deep system access without requiring further user intervention.

Summary of Defensive Recommendations

To protect against these threats, security experts recommend the following measures,

• Official Sources - Only download applications from official repositories like the Google Play Store.
• Suspicious Links - Treat unsolicited emails, SMS messages, or social media links with extreme caution.
• Endpoint Protection - Utilize reputable mobile and desktop security software to monitor for anomalous behaviour.
• Verification - Be wary of any banking website or app that requests unusual permissions, such as enabling Accessibility Services, especially if it appears after clicking a link.

Need a sanity check on your architecture?

Email [email protected] today for a free security checkup.

We will conduct a candid, expert assessment of your environment and provide actionable feedback to fortify your defences against the threats of 2026.

Originally published on LinkedIn.