Windows Banking Trojan Grandoreiro Adds WebRTC, DLL Sideloading to Evade Detection

Grandoreiro is a banking Trojan targeting Windows devices, primarily threatening financial institutions and bank customers in Europe and Latin America. Attackers can use it to steal online banking credentials, including usernames and passwords, and even intercept transactions. Its evolving capabilities therefore pose a direct risk to personal assets and financial-system security.

Cybersecurity firm WatchGuard recently disclosed that a new Grandoreiro variant uses DLL sideloading to load malicious components through legitimate programs. It also uses WebRTC to establish covert connections and reduce the likelihood of detection by security tools. The report did not disclose the exact discovery date, the value of losses or the number of infections.