GoPix banking Trojan targeting Brazilian financial institutions

GoPix is an advanced persistent threat targeting Brazilian financial institutions and cryptocurrency users. It uses memory-only implants and obfuscated PowerShell scripts, evolving from previous RAT and ATS threats. The malware employs sophisticated techniques, including malvertising via Google Ads, man-in-the-middle attacks, and monitoring of Pix transactions and Boleto slips. GoPix bypasses security measures, maintains persistence, and uses robust cleanup mechanisms. It leverages multiple obfuscation layers and a stolen code signing certificate to evade detection. The threat actors carefully select victims, including financial bodies of state governments and large corporations, using legitimate anti-fraud services for targeted delivery.

• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• Sandbox Flipped to 'Danger-Full-Access': Unauthorized AI Relays Create Risk for OrganizationsCampaign2026-10-29
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16