The malware is typically spread via malspam campaigns containing a URL that directs recipients to an infection zone. The first stage of infection is a loader component. Our team located a number of loaders used by Grandoreiro attackers masked as invoice files with a .msi extension and placed into an easily accessible GitHub repository. The second stage of the infection fetches the Grandoreiro payload via a hardcoded URL within the loader’s code. Grandoreiro is executed and infects the device