Grandoreiro, a Brazilian banking trojan, has evolved since 2016 to become a global threat, targeting 1,700 banks and 276 crypto wallets in 45 countries. Despite arrests of some operators, the group remains active, with new versions featuring updated code and lighter versions focused on Mexico. The trojan’s infection chain typically starts with phishing emails containing malicious ZIP archives that download the Grandoreiro payload.