An old Spanish banking trojan from at least 2015 has resurfaced again with a new attack flow and stealth techniques. The “Mekotio” trojan has been seen in the news in July 2021 when Spanish law enforcement arrested sixteen (16) individuals from a criminal organization connection to the operation of Mekotio and another banking trojan Grandoreiro. Mekotio’s primary goal has always been to steal banking credentials and account passwords, though it has removed its cryptocurrency stealing feature which was included in previous editions. The upgraded Mekotio uses spam campaigns to distribute the malware, which includes emails that claim to be a digital tax receipt with a malicious link. The link downloads a zip file which contains a batch and PowerShell script that installs the malware on Windows. The scripts download another zip file containing an AutoHotkey script and a malicious DLL containing the trojan. New versions of the malware include three additional functionalities which make Mekotio stealthier. These include: two layers of obfuscation in the batch file, a file-less PowerShell script that runs in memory, and the use of Themida v3 to pack the malicious DLL. CTAPT analysts are monitoring the development of Mekotio and will update if any new versions appear.