The Grandoreiro banking malware uses remote overlay and a fake Chrome browser plugin to steal from banking customers. The trojan has been targeting banks in Brazil and Latin America, and is now expanding its targets to more countries including Spain. The attack uses COVID-19-themed videos to trick users into running a concealed executable, infecting devices with a remote-access. The trojan is capable of overtaking devices and displaying a full-screen overlay image when victim accesses their online banking account. Meanwhile, the attacker initiates a fraudulent money transfer from the compromised account in the background.
The attack flow is the usual malspam to trick users into clicking a URL that takes them to a malicious website. Victims are then persuaded to download a .MSI file from a Github repository, which is actually the malware loader. The Grandoreiro payload is then fetched via a hardcoded URL within the loader’s code. After download, Grandoreiro establishes a connection with its command-and-control (C2) server, which allows the malware to send notifications about machine information and facilitate remote access capabilities to the attacker when a victim accesses a banking site. One unique technique utilized by Grandoreiro’s operators is the download of a malicious extension for the Google Chrome browser. This extension pretends to be a “Google Plugin” version 1.5.0., and is added as a visually square button to the browser window.
The extension asks victims for various permissions, including reading victim browsers’ history, displaying notifications, modifying data that’s copied and pasted and more. This extension may be grabbing the victim’s cookies to use them from another device to ride the victim’s active session.