# Banking Trojans: Manic, Grandoreiro, and ToxicPanda 2.0 in the Spotlight

> Three concurrently active banking-trojan campaigns show rapid escalation in scope and tradecraft: Manic, an Android banker/spyware hybrid (ThreatFabric) targeting Ukraine with novel offline Bluetooth/Wi-Fi Direct mesh-relay exfiltration; Grandoreiro, a decade-old Brazilian Windows banker (Acronis TRU) now DLL side-loading via the legitimate Duplicate Files Finder app in a Mexico-focused campaign; and ToxicPanda 2.0 (Zimperium), which expanded from 16 to 167 remote commands, now targets ~350 financial apps across 16 countries, and abuses Android Wireless Debugging for privilege escalation while distributing via AWS S3 buckets and Telegram bot APIs.

- **Published:** 2026-08-22T00:00:00Z
- **Last reviewed:** 2026-08-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2118
- **ID:** TL-2026-2118
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Three independently reported but concurrently active banking-trojan campaigns were disclosed by three separate vendor research teams within the same week of August 2026, illustrating how quickly banking-malware operators are iterating on both mobile and desktop platforms.

Manic (ThreatFabric) is a newly profiled Android malware family that blends banking-fraud tooling with full spyware capability. Its infrastructure was first registered in February 2026, with a first wrapper/lure app (posing as a booking utility) appearing in May 2026 and the core implant emerging at the end of that month; a second, hardened deployment followed on or around July 13, 2026, with a management panel/API stood up between July 24-28, 2026. Manic abuses Android's Accessibility Service to overlay a fake keypad on top of legitimate banking apps (pinPadOverlay) and to auto-enter stolen PINs on the lock screen (autoEnterPin), intercepts SMS/notifications for one-time codes and cryptocurrency recovery phrases, and supports full device takeover via WebRTC remote sessions with screen concealment overlays. It monitors 169 target package IDs spanning Ukrainian, Russian, and broader European banks, government/eID services, cryptocurrency exchanges, P2P/BNPL payment apps, and both commercial and military-oriented messaging apps. Its most distinctive feature is an offline "store-and-forward" mesh relay: when direct C2 access is unavailable, collected data is AES-GCM encrypted and hopped across up to four nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT until it reaches attacker infrastructure, with background workers/alarms and accessibility/notification listeners re-triggering the relay and exfiltration logic roughly every 10-15 minutes for persistence. Distribution is via phishing sites and dropper apps impersonating utilities, and the July build added in-memory DEX loading, launcher removal, and stronger anti-analysis checks. Manic's bot protocol exposes 26 distinct commands spanning remote control, log/location/screenshot capture, SMS/call/contact/file exfiltration, USSD execution, forced device lock, Google Play Protect disabling, and permission escalation. ThreatFabric's telemetry shows a development gap between late June and mid-July 2026 before the hardened second deployment emerged.

Grandoreiro (Acronis TRU) is a roughly decade-old Brazilian-origin Windows banking trojan that survived a January 2024 Spanish/Brazilian law-enforcement disruption (Operation Grandoreiro) and continues to evolve. Acronis TRU's newly observed campaign, first seen in May 2026 with telemetry through June 2026, abuses the legitimate "Duplicate Files Finder" Windows utility: the attackers rename the trusted executable and place a malicious mingwm10.dll alongside its legitimate dependencies, causing DLL side-loading that runs attacker code under a trusted process. The initial loader performs extensive anti-analysis before ever contacting its C2 infrastructure -- checking for virtualization/sandbox artifacts, security and analysis tooling, process blacklists, and victim geolocation/country. Concretely, the loader's parent process suppresses its own GUI window, then queries the third-party geolocation service ip-api.com followed in quick succession by a read of the Windows registry value HARDWARE\DESCRIPTION\System\BIOS (a common VM-vendor-string sandbox check), and the literal marker string CLIENT_SOLICITA_DDS_MDL appears in the malware's C2 solicitation traffic/memory as a distinctive detection artifact. The precise initial-delivery vector was not directly confirmed, but an invoice-themed ZIP filename and Grandoreiro's historical spam-based distribution pattern led Acronis TRU to assess with moderate confidence that malspam was the delivery method. The C2 server was offline at analysis time. Telemetry over the analyzed window shows the campaign is now concentrated in Latin America with a notable northward shift: Mexico accounted for 40% of detections, followed by Spain (17%), Peru (13%), and Argentina (10%), with smaller clusters in Europe and North America.

ToxicPanda 2.0 (Zimperium zLabs), also tracked as TgToxic, is a major capability upgrade to the existing ToxicPanda Android banking trojan, expanding its remote command set from 16 to 167 commands and its targeted financial-application list from 16 to roughly 349 banking, e-wallet, and cryptocurrency apps across 16 countries (including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama); a dedicated PIN-harvesting workflow further targets 140+ of those banking and cryptocurrency apps specifically. New commands documented include catAllViewSwitch (automating OEM-specific permission prompts across different Android vendor skins), admSet/admPwd (abusing Device Administrator APIs via DevicePolicyManager to force-reset the device lock PIN/password), transparent (a full-screen WebView used to deliver phishing content over legitimate banking UI), autoBoot (bypassing OEM-specific auto-start/power-management restrictions on vendors including Xiaomi, OPPO, Vivo, Samsung, and Huawei for reboot persistence), and replacePinTargets (dynamically updating which apps are targeted for PIN theft). Its most notable new technique automates abuse of Android 11+ Wireless Debugging: the malware uses the Accessibility Service to simulate seven rapid taps to unlock Developer Options, navigates to and enables Wireless Debugging, continuously polls the pairing-dialog UI hierarchy to capture the SPAKE2 six-digit pairing code and dynamic port, completes the SPAKE2 cryptographic pairing to establish a TLS-encrypted ADB channel, and then issues high-privilege shell commands through the ADB daemon -- bypassing normal runtime consent prompts entirely. C2 communication uses an HTTPS handshake followed by a persistent WebSocket channel encrypted with AES in ECB mode using embedded static keys. Samples and droppers are distributed from Amazon AWS S3 buckets across multiple regions (ap-south-1, mx-central-1, ap-southeast-1) as well as via the Telegram Bot API, and a companion phishing domain (googleplaydown.com) impersonates the Google Play Store to lure installs. Zimperium published IOCs (C2 infrastructure, sample hashes, dropper/phishing URLs, and targeted package names) to its public zLabs IOC repository under the 2026-08-ToxicPanda directory.

Collectively, all three campaigns underscore that banking-trojan operators are converging on abuse of legitimate platform features -- Android Accessibility Service and Device Administrator APIs, Android Wireless Debugging, and Windows DLL search-order/side-loading -- rather than novel exploits, making detection reliant on behavioral and configuration-hardening controls rather than patching.

## MITRE ATT&CK

- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1574.001 DLL
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1518.001 Software Discovery: Security Software Discovery
- T1057 Process Discovery
- T1660 Phishing
- T1417.002 Input Capture: GUI Input Capture
- T1417.001 Input Capture: Keylogging
- T1636.004 Protected User Data: SMS Messages
- T1636.003 Protected User Data: Contact List
- T1512 Video Capture
- T1430 Location Tracking
- T1437.001 Application Layer Protocol: Web Protocols
- T1639 Exfiltration Over Alternative Protocol
- T1404 Exploitation for Privilege Escalation
- T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1603 Scheduled Task/Job

## Sources

- [Banking Trojans: Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight](https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/)
- [Manic: Blend between Banking Malware & Spyware](https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware)
- [Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign](https://www.acronis.com/en/tru/posts/grandoreiro-goes-north-from-brazil-to-mexico-with-a-new-dll-sideloading-campaign/)
- [The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile](https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile)
- [Zimperium/IOC -- 2026-08-ToxicPanda indicator set (c2.csv, apks.csv, dropers.csv, phishing.csv, commands.md)](https://github.com/Zimperium/IOC)
- [Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign](https://www.infosecurity-magazine.com/news/grandoreiro-mexico-dll-sideloading/)
- ['Grandoreiro' Malware Resurfaces With Mexico Campaign](https://www.darkreading.com/cyberattacks-data-breaches/grandoreiro-resurfaces-mexico-campaign)
- [Grandoreiro banking trojan resurfaces with new campaign targeting Latin America](https://www.scworld.com/brief/grandoreiro-banking-trojan-resurfaces-with-new-campaign-targeting-latin-america)
- [Grandoreiro Banking Trojan Resurfaces With DLL Sideloading Campaign in Mexico](https://www.broadcom.com/support/security-center/protection-bulletin/grandoreiro-banking-trojan-resurfaces-with-dll-sideloading-campaign-in-mexico)
- [Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices](https://thehackernews.com/2026/08/manic-android-malware-exfiltrates-data.html)
- [ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud](https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html)
- [ToxicPanda 2.0 Targets 349 Financial Apps and Abuses Android ADB for Shell-Level Access](https://cyberpress.org/toxicpanda-2-0-abuses-android-adb/)
- [Zimperium zLabs Uncovers ToxicPanda 2.0, a Significantly More Powerful Android Banking Trojan](https://www.prnewswire.com/news-releases/zimperium-zlabs-uncovers-toxicpanda-2-0--a-significantly-more-powerful-android-banking-trojan-302854782.html)
- [Manic Android Malware Steals Banking PINs and Takes Remote Control of Devices](https://cyberpress.org/manic-android-malware-steals-banking-pins-takes-remote-control/)
- [Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline](https://securityaffairs.com/197570/malware/manic-the-android-malware-that-exfiltrates-data-even-when-the-phone-is-offline.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2118