brazil4 articles
KREMLIN Malware Uses Ethereum Smart Contracts and Rogue Browser Extensions to Drain Brazilian Bank Accounts
KREMLIN is a Brazilian banking malware ecosystem, tracked by Elastic Security Labs since at least May 2025, that uses multi-stage JavaScript loaders and malicious browser extensions to steal credentials, session tokens, and sensitive data from victims impersonating customers of over a dozen Brazilian banks. A key feature of the operation is its use of Ethereum smart contracts to dynamically update command-and-control infrastructure, making it highly resilient to disruption. The malicious browser extensions bypass Chromium's security mechanisms to harvest cookies, screenshots, and browsing data, with over 1,500 infected systems identified — more than 98% located in Brazil.
Two Criminal Groups Are Quietly Gutting Brazil's Financial Infrastructure
A newly identified threat actor called **Slim Spider** has been conducting sophisticated attacks on Brazilian financial institutions since at least March 2026, targeting cryptocurrency assets and instant payment accounts linked to Brazil's Pix system. The group demonstrates advanced cloud security knowledge, using custom scripts to steal cloud credentials, enumerate secrets, and derive Ethereum wallet addresses, while deploying backdoors and malicious pipelines to maintain access and evade detection. Separately, another cybercrime group called **Breeze Comet** has been infiltrating Brazilian financial systems since 2024 to execute fraudulent transactions via Pix and other payment infrastructure, with both groups highlighting a broader shift from retail banking fraud toward direct attacks on core financial infrastructure.
Chinese Threat Actor Is Quietly Hijacking Brazilian Government Websites to Rank Gambling Pages
A Chinese-speaking cybercrime group called Gambling Goblin (linked to Earth Berberoka) has been compromising Brazilian government and educational web servers since mid-2025, installing malicious Apache modules that silently redirect visitors to fake app stores promoting illegal online gambling and sports betting. The primary objective appears to be large-scale SEO manipulation, exploiting the high-reputation domains of legitimate government sites to artificially boost search rankings for gambling pages, with over 630,000 URLs reportedly generated across hijacked Brazilian government subdomains. The group deploys a sophisticated toolkit including backdoors, a RAT, credential stealers, and an SSH brute-forcer, and it is part of a broader trend of China-aligned actors using similar server-hijacking techniques — mirroring a parallel campaign by a separate group called GhostRedirector that targeted IIS servers across Brazil, Thailand, and Vietnam.
Brazilian Gov Websites Hijacked to Deliver Malware in Active Banking Campaign
A cyberattack campaign called PhantomEnigma has compromised more than 20 Brazilian government websites, turning them into malware delivery channels targeting banks and public agencies. The operation uses fake police-themed documents sent via authenticated emails and trusted `.gov.br` domains to deceive victims into installing a modular backdoor capable of stealing credentials, establishing persistence, and delivering additional payloads. The campaign's abuse of legitimate government infrastructure and rotating command-and-control domains makes it particularly difficult to detect using conventional security tools, with behavioral analysis recommended as a more reliable defence.