Active campaigns are delivering the Grandoreiro banking trojan to Windows endpoints and the BTMOB RAT to Android devices, targeting financial sector organizations and customers in Spain, Portugal, and Mexico. The dual-platform deployment eliminates gaps left by organizations that harden only one channel; defenders must address Windows endpoint, Android MDM, and banking session security simultaneously.