---
title: Three Banking Trojans — Manic, Grandoreiro, and ToxicPanda 2.0 — Are Actively Targeting Users Worldwide
description: New findings from ThreatFabric, Acronis, and Zimperium detail fresh tactics — from offline data relays to cloud-hosted payloads — behind three active banking trojans.
canonical_url: https://codekeeper.co/ticker/dangerous-banking-trojans-targeting-europe-and-latin-america
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Three Banking Trojans — Manic, Grandoreiro, and ToxicPanda 2.0 — Are Actively Targeting Users Worldwide

New findings from ThreatFabric, Acronis, and Zimperium detail fresh tactics — from offline data relays to cloud-hosted payloads — behind three active banking trojans.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 24, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybersecurity researchers are flagging three dangerous banking trojans making the rounds. Manic, an Android malware detailed by ThreatFabric, combines banking fraud with spyware and targets Ukraine, Russia, and European financial institutions — even using Bluetooth and Wi-Fi to relay stolen data when internet access is unavailable. Grandoreiro, a decade-old Windows trojan from Brazil, remains active per the Acronis Threat Research Unit, though at considerably lower volume than before a January 2024 law enforcement takedown. It's still hitting Latin America, with a more limited presence in Europe, and recent attacks have focused on Mexico. The trojan now hides inside a legitimate file-finder app to dodge detection. ToxicPanda 2.0, flagged by Zimperium, is the biggest upgrade — now targeting 349 financial apps across 16 countries and delivering payloads through Amazon AWS. **Source:** [SecurityWeek](https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fdangerous-banking-trojans-targeting-europe-and-latin-america%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data breaches Hackers Dump 8.7 Million Airport Customers' Data on the Open Internet Sep 4, 2026](https://codekeeper.co/ticker/manchester-airports-data-breach-exposes-travel-info)

[Hackers Are Using Fake Passkey Requests to Break Into Microsoft 365 Accounts Sep 11, 2026](https://codekeeper.co/ticker/microsoft-365-phishing-campaign-bypasses-mfa)

[South Korea Hits Coupang With Record $400M+ in Data Breach Fines Aug 12, 2026](https://codekeeper.co/ticker/coupang-data-breach-fine-400-million)

[Vulnerabilities Critical GitLab Flaw Actively Exploited to Steal Server Secrets Sep 24, 2026](https://codekeeper.co/ticker/gitlab-vulnerability-cve-2026-85706-exploitation)