Do Son Operation Master used a GlobalProtect flaw to steal utility data, then fed it into an invoice fraud platform that sent 2.4M+ fake bills in Brazil.
Brazil
JanelaRAT targets banking users in Brazil and Mexico using window monitoring and fake updates. Learn how this 2026 threat bypasses MFA to hijack sessions.
Apple settles with Brazil's CADE, agreeing to allow third-party app stores and external payments by April 2026. See the new 15% and 5% fee structures.
Water Saci Campaign Uses LLMs to Convert Malware to Python, Spreads Banking Trojan Via WhatsApp Worm
Water Saci Campaign Uses LLMs to Convert Malware to Python, Spreads Banking Trojan Via WhatsApp Worm
Trend Micro exposed Water Saci, a campaign using LLMs to convert malware from PowerShell to Python, accelerating its spread via a WhatsApp worm. The multi-stage attack deploys a trojan capable of VNC mirroring and overlay attacks.
RelayNFC is a new, zero-detection Android malware targeting Brazil that turns the victim's phone into a remote card reader to steal data and complete real-time contactless payments.
Trustwave exposed Eternidade Stealer, a sophisticated Brazilian Trojan. The Python WhatsApp worm steals contact lists and uses IMAP email for covert C2 retrieval to launch banking overlays.
Tap-and-Steal: Over 760 Android Apps Exploit NFC/HCE for Payment Card Theft in Global Financial Scam
Tap-and-Steal: Over 760 Android Apps Exploit NFC/HCE for Payment Card Theft in Global Financial Scam
Zimperium found 760+ Android apps exploiting NFC/HCE to steal payment data. The malware impersonates 20 banks across Russia, Poland, and Brazil, using Telegram for criminal coordination.
BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.
Herodotus is a new Android banking Trojan that evades anti-fraud systems by simulating human input: it inserts randomized typing delays (300-3000ms) during remote-control attacks in Italy and Brazil.
Trend exposed the Water Saci worm, a self-propagating campaign that hijacks WhatsApp Web using Selenium/PowerShell. It uses a stealthy IMAP email C2 channel with HTTP fallback.
Doctor Web exposed Android.Backdoor.Baohuo.1.origin, a malware hiding in a Telegram X clone. It uses a Redis database for C2, infects 58K+ devices, and steals crypto wallet info from the clipboard.
Kaspersky exposed Maverick, a sophisticated fileless banking Trojan targeting Brazil. It hijacks WhatsApp Web using WPPConnect for self-propagation and installs phishing overlays to steal UPI/banking data.
McAfee uncovered the Astaroth banking Trojan using GitHub for C2 backup, hiding encrypted configuration data via steganography in images to target Brazilian financial and crypto users.
Trend Micro uncovered "Water Saci," a self-propagating malware (SORVEPOTEL) that hijacks WhatsApp Web sessions to spread aggressively and steal Brazilian banking credentials.
A ransomware attack on a major Brazilian healthcare software provider exposes over 94,000 sensitive patient files, highlighting a new cyber threat.
Kaspersky exposes a new AV killer leveraging the legitimate ThrottleStop.sys driver to disable antivirus software and deploy MedusaLocker ransomware in a BYOVD attack.
Zscaler reveals an AI-powered phishing campaign targeting Brazilian users. DeepSite AI and BlackBox AI generated fake government websites to steal Pix payments and personal data.
Opera has filed an antitrust complaint against Microsoft in Brazil, accusing it of anti-competitive practices by bundling Edge with Windows and hindering rival browsers.
A misconfigured Google Cloud Storage bucket belonging to CIEE exposed 248,725 sensitive Brazilian records, including medical reports and job videos, now published by data broker "888."
Cisco Talos warns of a Brazil-focused spam campaign abusing legitimate remote access tools (N-able, PDQ) to gain full system control. Stay vigilant!
TAG and Mandiant's frontline intelligence team have detailed the unique and intricate cyber threat landscape facing Brazil