Friday, December 8, 2023

Beware of Coronavirus-themed Grandoreiro Malware Attacks Bank Customers Via Chrome Plugin

Researchers observed a massive campaign of Grandoreiro, a remote-overlay banking Trojan targets the large Spanish banking customers to empty their banking accounts via a fake chrome browser plugin.

Malspam campaign distributes Grandoreiro malware, tricked the users to run the COVID-19 themed videos to infect the user machine.

After that, it enables the fake chrome browser extension to steal the victim banking site cookies for fraudulent money transactions.

Grandoreiro Malware operators expanding the scope from Brazil to Spain banking customers

Eset Researchers observed fake websites abusing novel coronavirus themed video named “” targets brazil bank customers to infect with Grandoreiro banking trojan in February.

Grandoreiro Malware Attacks
COVID-19 themed video downloads Malware

The remote-overlay malware began trending in Brazil in the year of 2014 and become the top financial malware threat across the Latin America region.

IBM X-Force researchers Observed the first stage of infection containing a URL that redirects to masked invoice files with a.msi extension placed in Github repository.

The loader fetches the second stage of Grandoreiro payload via hardcoded URL to download and infect the device.

Some sample images show that it also asks users to install a supposed security application as below:

Grandoreiro Malware Attacks
Fake App

Grandoreiro bot communicates with its C&C server using a communication algorithm, which generates the second part of the path as below, but this connection establishes based on the infected device’s set date has to match with a recent campaign date in order to successfully connect the C&C server. This gives an operational security feature on the attacker side and also C2 server is encrypted and transmitted over SSL protocol.


Bot communication HTTP Pattern

The malware writes a compressed archive file named from which it will extract additional files, placing them into a directory under C:/%user%/*extension folder*/*.

The extracted files are modified versions of an existing, legitimate Google Chrome browser extension called Edit This Cookie.

In the next step to setup the fake browser, the new Chrome browser shortcut contains a “—load-extension” parameter to load the new extension upon starting the browser.

Fake chrome browser Plugin

Here is an example of a target path of fake browser plugin:

“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” –load-extension=”%userprofile%\F162FD4091BD6D9759E60C3″

Since this malicious extension is trying to pass for a legitimate Chrome plugin, Grandoreiro’s developer named it “Google Plugin” version 1.5.0. Visually, it adds a square button to the browser window instead of the “cookie” button on the original plugin.

Grandoreiro Malware Attacks
Fake chrome browser plugin permissions

Using the modified extension, the attacker can collect user information from cookies. Some of the collected information includes the following fields:


Researchers suspect that the malware uses this extension to grab the victim’s cookies to make fraudulent money transactions. With this method, the attacker won’t need to continue controlling the victim’s machine.

Indicators of compromise (IoC):


Related Read

CoronaVirus Cyber Attack Panic – Threat Actors Targets Victims Worldwide

Chinese APT Hackers Exploit MS Word Bug to Drop Malware Via Weaponized Coronavirus Lure Documents

How Can The Coronavirus (COVID-19) Disrupt Cybersecurity Operations?


Latest articles

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles