Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

The article discusses two banking malware campaigns targeting Latin America and Europe: Grandoreiro for Windows and BTMOB for Android devices.

• •Grandoreiro uses DLL side-loading with Delphi-developed DLLs incorporating WebSocket/WebRTC libraries and STUN/ICE protocols to hide in legitimate traffic
• •The malware evolved to include CAPTCHA checks and continues targeting banks across 45 countries despite law enforcement attempts
• •BTMOB is an Android RAT with APK builder interface allowing non-technical actors to generate payloads without coding
• •BTMOB exploits accessibility services for system permissions and spreads via fake app stores and phishing sites
• •BTMOB operates as malware-as-a-service for $700/month or $1,200 lifetime, with leaked source code circulating on underground forums