The Tetrade is coined for four large banking trojan families created, developed and spread by Brazilian threat actors on a global level. Brazilian banking trojans have evolved greatly, with hackers adopting techniques for bypassing detection, creating highly modular and obfuscated malware, and using a very complex execution flow, which makes analysis a painful, tricky process. These four banking trojan families: Guildma, Javali, Melcoz and Grandoreiro, are now fully developed and are expanding abroad. Guildma spreads rely heavily on malspam containing a malicious file in compressed format, attached to the email body. File types vary from Visual Basic Script to LNK. Most of the phishing messages emulate business requests, packages sent over courier services or any other regular corporate subjects, including the COVID-19 pandemic, but always with a corporate appearance.