Grandoreiro is a banking trojan used to steal credentials and session data from victims. It typically targets online banking and financial workflows, then sends stolen information to attackers for fraud. Defenders should monitor for fake overlays, unusual browser manipulation, and outbound traffic from endpoints, then block suspicious transactions and verify affected accounts.
What Grandoreiro Is Used For
Grandoreiro is built to intercept online banking activity at the point of use, where a victim is already authenticated and ready to approve transactions. That makes it especially dangerous because it can turn a legitimate session into a fraud channel without needing to break the bank’s front door.
In practice, the trojan is less about noisy disruption than about stealthy manipulation of the banking workflow. It targets the browser, the user’s view of the session, and the data being prepared for theft, which lets attackers capture valuable financial information while appearing to operate inside a normal customer interaction.
How Grandoreiro Steals Banking Data
The core technique is credential and session theft. Once installed, banking malware of this kind can capture usernames, passwords, cookies, one-time session material, and transaction details, then forward them to an attacker-controlled endpoint for reuse or monetisation.
That matters because session data is often as useful as a password. If an attacker can replay or hijack an active browser session, they may bypass normal login friction, especially when the victim has already passed strong authentication earlier in the workflow.
Grandoreiro also shows why browser-based fraud is so effective: it can operate through fake overlays, injected prompts, or altered page content that nudges the victim into entering sensitive data or approving a malicious action. The user thinks they are responding to the bank, while the malware is mediating the exchange.
Exposure, Detection, and Investigation
Organisations should treat this family as a blend of endpoint compromise and account compromise. Exposure is highest where users access banking or payment portals from unmanaged endpoints, where browser activity is not monitored, or where outbound connections from infected machines are not being inspected for suspicious destinations.
Detection usually depends on correlating endpoint behaviour with network and account signals. Unexpected browser manipulation, abnormal child processes, unfamiliar overlays, and outbound traffic from a workstation during a banking session are all strong clues that the endpoint, not just the account, has been compromised.
Post-incident review should focus on what the malware could have seen or changed during the active session, including the possibility that transactions were modified before submission. For a broader control baseline on endpoint monitoring, authentication hygiene, and response discipline, practitioners can map this class of threat to NIST SP 800-53 Rev 5 Security and Privacy Controls, MITRE ATT&CK Enterprise Matrix, and NIST Cybersecurity Framework 2.0.
Why Banking Trojans Like Grandoreiro Matter
Grandoreiro is a reminder that financial fraud often starts before the bank sees anything unusual. The attacker’s advantage is not only malware execution, but the ability to exploit trust in the endpoint, the browser, and the authenticated session at the same time.
That is why financial organisations, fraud teams, and defenders should think beyond simple password theft. Once a trojan can observe the session, steal the data, and influence what the user approves, it can convert a legitimate customer journey into an attacker-controlled transaction path.
Risk and Threat Considerations
Grandoreiro creates material fraud risk because it can capture live session material and alter what the victim sees before a transaction is approved. The danger is not limited to stolen credentials, it also includes session abuse, transaction tampering, and delayed discovery after the attacker has already monetised the access.
Failure mechanism: The malware compromises the endpoint or browser, intercepts banking activity in real time, and relays stolen data or manipulated transactions to the attacker.
Impact: Victims can lose account access, suffer unauthorised transfers, and face account recovery work that is complicated by the reuse of valid session state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Grandoreiro steals credentials and session data that auth controls must protect. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Banking trojans are detected by reviewing endpoint, browser, and transaction activity. | |
| Recommendation — Protect and rotate authenticators so stolen login material cannot be reused for banking fraud. Correlate endpoint and transaction logs to spot hijacked sessions and suspicious browser manipulation. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find anomalies and events | Outbound traffic from infected endpoints is a key detection signal for this malware. |
| Recommendation — Monitor endpoint and network traffic for suspicious connections during banking sessions. | ||
| MITRE ATT&CK | T1056 — Input Capture | Grandoreiro captures credentials and session input from victims during use. |
| Recommendation — Map observed keystroke or form capture behaviour to T1056 and investigate the affected host. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Session theft turns a valid authenticated flow into attacker misuse. |
| Recommendation — Harden session handling so stolen authentication material cannot be replayed or abused. | ||
Practitioner Guidance
What to watch for: Prioritise telemetry that shows a mismatch between user intent and endpoint behaviour, especially during banking sessions. A bank login that is followed by unusual browser manipulation or suspicious outbound traffic should be treated as a likely compromise, not just a user issue.
Practitioner takeaway: With banking trojans, the decisive control is often rapid containment of the endpoint and the transaction path, because once the session is stolen, the attacker may already be operating inside the customer workflow.