Grandoreiro Banking Trojan DLL Side-Loading via Phishing Delivery

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects instances where specific DLLs known to be abused in malicious contexts (libwebp.dll, mingwm10.dll, libffi-6.dll, libpng15.dll) are loaded by common productivity and scripting processes, such as Microsoft Office applications (Word, Excel, Outlook) or scripting engines (wscript.exe, mshta.exe). This pattern is often indicative of side-loading or exploitation of malicious documents and scripts.