BREEZE COMET, a financially motivated threat actor, has launched a Pix fraud campaign against Brazilian banks, deploying custom malware and AI‑enhanced tools to siphon funds. The activity was first observed in early September 2026 and has already resulted in unauthorized transfers from multiple financial institutions, with estimates suggesting losses in the tens of millions of reais. Details of the operation come from a securityonline.info report here and a Google Threat Intelligence blog post.
The intrusion begins with password spraying against external services, allowing the group to gain a foothold before installing a remote monitoring and management tool. Once inside, attackers deploy a custom backdoor that interacts with the Pix payment interface, using machine learning scripts to generate realistic transaction requests at high volume. The malware also creates scheduled tasks and modifies legitimate Windows services to maintain persistence across reboots.
Network traffic is encrypted and routed through compromised web proxies, which helps the operation blend with normal business activity and delay detection.
Previously tracked as UNC5669, BREEZE COMET has also been observed inserting malicious hardware into point‑of‑sale devices to harvest card data and credentials. In compromised networks the actor escalates privileges, accesses the National Financial System backbone and abuses cloud‑hosted resources to host command‑and‑control infrastructure. The group uses legitimate administrative tools for lateral movement, then exfiltrates stolen data via encrypted channels to external drop zones. No public CVE identifiers are associated with the current toolkit, which relies on bespoke code rather than known vulnerabilities.
Google Threat Intelligence and Mandiant first observed the activity on 1 September 2026, with the initial sighting at 03:51 UTC and the latest at 04:56 UTC. The campaign aligns with earlier financially motivated operations seen in 2024, indicating a refined focus on Brazil’s instant payment ecosystem. Researchers note that the actor combines traditional credential theft with AI‑driven transaction automation to increase success rates. Both the securityonline.info report and the Google blog provide detailed timelines and observed tactics here.
Defenders should enforce multi‑factor authentication on all external‑facing services and monitor authentication logs for spikes in failed login attempts indicative of password spraying. Remote monitoring and management software must be tightly controlled, with allowlisting and strict approval workflows. Endpoint detection and response tools need to be tuned to detect the custom backdoor’s registry changes and unusual Pix API calls, while network segmentation limits lateral movement to critical financial servers.
Additionally, security teams should enable detailed logging of Pix transaction requests and set thresholds that trigger alerts when volumes exceed normal business patterns.
Organisations should also keep operating systems and third‑party applications patched, run regular user‑awareness training that highlights phishing and credential‑theft tactics, and maintain offline backups of critical transaction logs. Sharing indicators of compromise with national CSIRTs and financial ISACs helps build a collective defence against future Pix‑focused fraud. Incident response plans must be exercised regularly, with tabletop exercises that simulate a Pix‑fraud scenario and test communication flows between treasury, IT and legal teams.