This week, security researchers are sharing information about new and updated banking trojans that attack users worldwide. Such malware is designed to steal login credentials, exfiltrate sensitive data, and take compromised devices under remote control. For organizations, the impact goes beyond suspicious apps: it also creates a direct lifeline to fraud, because victims are led via phishing to deceptive screens.
In the spotlight are three families: Manic (Android), Grandoreiro (Windows), and ToxicPanda 2.0 (Android). Below, you’ll find what has been observed, which techniques stand out, and how you can strengthen your own resilience.
Manic: Android trojan for banking én spyware
ThreatFabric describes Manic as Android malware that combines two roles: a banking trojan and spyware. The threat is primarily linked to attacks on Ukraine, including banks, government services, and messaging apps. Still, Manic has also been seen targeting organizations in Russia and parts of Europe, as well as platforms connected to crypto and fintech.
According to the report, distribution takes place via malicious websites and so-called droppers. Once Manic is on a device, the malware can capture keystrokes, display phishing screens, and operate the device remotely to support banking and cryptocurrency fraud.
What makes the situation even more serious is that Manic doesn’t stop at “banking.” The spyware component includes capabilities such as monitoring notifications, location tracking, collecting files, and observing the device remotely.
Offline mesh relay when C2 isn’t reachable
A notable feature is the “offline mesh relay.” With this, collected data can be forwarded through nearby infected devices via Wi‑Fi Direct or Bluetooth, even when direct access to the command-and-control (C2) infrastructure is unavailable. In other words, the malware tries not to depend on a single direct connection for communication and data transfer.
Grandoreiro remains active and adapts via legitimate software
Grandoreiro is also still present, according to the Acronis Threat Research Unit. The focus is particularly on users in Latin America, but earlier campaigns showed targeting across Europe as well. In a recent overview of observations, the highest numbers of victims appeared to be in Mexico.
Grandoreiro has been around for quite some time—Acronis reports it as a Windows trojan of Brazilian origin that has been in circulation for about a decade. At the same time, the malware continues to evolve despite attempts by law enforcement to disrupt the threat.
A concrete development involves the abuse of a legitimate application: Duplicate Files Finder (DFF). Newer samples would use DFF to execute malicious code via DLL sideloading. This can help make activities look like normal software usage patterns, making detection more difficult.
Anti-analysis as a priority
According to Acronis, the first part of the attack includes a comprehensive anti-analysis package. Think of detection of sandbox environments and virtual machine artifacts, along with process blocking and environmental profiling. The report highlights that these checks are performed before the malware reaches out to the C2 infrastructure. This suggests that bypassing automated analysis is baked into the design choices.
For defenders, that’s important: “just check it in a sandbox” can be too late or produce misleading results if the malware doesn’t proceed once it detects analysis. That’s why rapid patching and strong source verification remain crucial—especially when legitimate software is used as camouflage.
ToxicPanda 2.0: more commands, more apps, and ADB abuse
Zimperium warns about an updated variant of ToxicPanda. This Android banking trojan typically targets mainly Europe, but Zimperium shows that the newest version includes major expansions.
One of the biggest changes is the scale of control and targeting. ToxicPanda 2.0 supports 167 remote commands and includes a target list with nearly 350 financial applications. In earlier versions, Zimperium reports the focus was around just 16 apps.
Additionally, the new campaign targets financial institutions in 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama. This broadens and complicates the impact, because it doesn’t appear to be focused on a single region or one set of institutions.
Automatic clicking via ADB for privilege escalation
ToxicPanda 2.0 also introduces an automated mechanism that works through Android Wireless Debugging (ADB). This would allow attackers to achieve privilege escalation and then obtain shell-level access on compromised devices.
If you don’t manage ADB day to day: the core idea is that the malware can abuse debugging functionality to gain more permissions for itself. That makes the attack useful for additional actions on the device—such as manipulating processes, strengthening persistence, or preparing further fraud steps.
Distribution via AWS buckets
Finally, Zimperium points to a shift in distribution. ToxicPanda 2.0 samples would be delivered from Amazon AWS-hosted buckets. That means attackers use cloud infrastructure to make malware available faster or to facilitate distribution more effectively. It’s a reminder that “the origin of the download” doesn’t necessarily provide a clear suspicious signal.
What can you learn from this as an organization?
Even though these cases are primarily technical, they can translate into practical patterns you see recurring in banking trojans. You keep seeing the same themes: deception aimed at financial apps, control over the device, and mechanisms to make analysis harder or keep communication active.
Here are steps that help in practice without you having to guess one specific malware family:
- Strengthen mobile authentication and monitoring: watch for unusual login patterns and fraud-related activity, even when the device itself appears “normal.”
- Update systems and apps: attacks targeting banking behavior often benefit from weaknesses in ecosystems, user settings, or vulnerable app versions.
- Limit and control debug/developer functions on mobile devices where possible, especially in environments where you manage business devices.
- Train for phishing: trojans use deceptive screens to harvest credentials. Quick recognition remains a strong defensive layer.
- Investigate signs of remote control: unusual app behavior, odd permissions, and abnormal network communication can be indicators.
If your organization works with a software supply chain or development pipelines, it’s also wise to understand that attackers increasingly combine multiple tracks—malware delivered through software paths, but also through misleading end users. For context on how supply chain attacks enable build-time malware, read also Source: https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/
