The Manic banking trojan is Android-based malware that integrates spyware capabilities such as keystroke logging, phishing overlays, remote device control, notification monitoring, location tracking, and file harvesting. It uniquely uses an offline mesh relay to exfiltrate data via nearby infected devices when direct command-and-control access is unavailable. Grandoreiro is a Windows banking trojan originating from Brazil, active for over a decade, targeting Latin America and Europe. It uses DLL sideloading through a legitimate application to evade detection and incorporates extensive anti-analysis features to avoid sandbox and virtual machine detection. ToxicPanda 2.0 is an Android banking trojan with a significant upgrade, supporting 167 remote commands and targeting nearly 350 financial applications across 16 countries. It abuses Android Wireless Debugging (ADB) for privilege escalation and shell access. Its distribution has shifted to using Amazon AWS-hosted buckets, leveraging cloud infrastructure for delivery.

These banking trojans enable attackers to steal banking credentials, sensitive user data, and cryptocurrency assets. Manic's spyware features and offline mesh relay increase its persistence and stealth. Grandoreiro's anti-analysis and DLL sideloading techniques make detection and disruption difficult. ToxicPanda 2.0's expanded command set and privilege escalation capabilities increase its control over compromised devices, while cloud-based delivery methods complicate blocking and mitigation efforts.

No specific patch or remediation is provided for these malware families, as they are threats rather than software vulnerabilities. Mitigation should focus on endpoint protection, user awareness to avoid malicious websites and droppers, and monitoring for indicators of compromise related to these trojans. Security teams should review threat intelligence updates from vendors like ThreatFabric, Acronis, and Zimperium for detection signatures and behavioral indicators. Since these are active malware campaigns, applying mobile and endpoint security solutions capable of detecting spyware and banking trojans is recommended.