This threat involves a banking malware campaign in Brazil that uses ClickFix social engineering to force-install a malicious Chrome extension via Chrome Cloud Management enrollment tokens. The extension masquerades as an official Banco Central do Brasil tool and targets eight financial institutions. The campaign has compromised 59 machines with seven active connections at the time of investigation. The operator's command-and-control server is completely unauthenticated, exposing all endpoints including administrative interfaces, live victim screenshots, stolen credentials in plaintext, and intercepted Pix payment data. Attribution was possible through WHOIS records revealing the operator's real identity. The campaign focuses on Northern Brazilian regional banks and credit cooperatives, with evidence of financial theft from a school fund account.

The campaign results in credential theft, session hijacking, and interception of Pix payment data from victims. The unauthenticated C2 infrastructure exposes sensitive stolen data and live victim information, increasing the risk of further exploitation or data leakage. At least 59 machines were compromised, affecting multiple Brazilian financial institutions and credit cooperatives. The attack undermines trust in Chrome extensions and cloud management enrollment mechanisms. The exposure of operator identity may aid law enforcement but does not mitigate ongoing risk to victims.

No official patch or remediation is indicated. Since the attack uses Chrome Cloud Management enrollment tokens to force-install the malicious extension, organizations should audit and restrict token issuance and enrollment permissions. Remove the malicious Chrome extension from affected machines and monitor for unauthorized extensions. Secure any exposed C2 infrastructure if under organizational control. Users should be alerted to avoid installing suspicious extensions and verify extension sources. Patch status is not yet confirmed — check vendor advisories and security community updates for remediation guidance.