Grandoreiro Screen Capture and WH_KEYBOARD_LL Keylogger Activity

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects process execution patterns associated with the Grandoreiro banking trojan, specifically the launching of browsers in kiosk mode for overlay attacks or the execution of suspicious non-UI binaries from scripts (wscript/cscript/mshta) located in user-writable directories.