The Grandoreiro banking trojan is being distributed via sophisticated malware attacks targeting users in Mexico, Argentina, and Spain through tax agency-themed phishing emails. The attacks exploit a multi-level infection process beginning with fake government notifications and malicious links. This campaign uses Contabo’s virtual private servers (VPS) and other legitimate services to complicate detection efforts and to facilitate a rapid shift in infrastructure as domains get flagged by security solutions.

Warning to developers: Stay away from these 10 VSCode extensions
Malicious extensions can be hard to detect, as they attempt to install a legitimate extension after being downloaded, providing the tool the user expected. The