Virus blocks transfers from country’s main banks via Pix

Via social media, several Brazilian account holders reported that there was something strange with transfers made through Pix. they were targeted a banking malware that exploits transfers and changes value and recipient. Fraud is caused by the BrasDex virus.

The malware remotely accesses users’ devices and bank accounts. It was discovered late last year by ThreatFabric, a cybersecurity company. At least 10 financial institutions affected.

Banks include Nubank, Inter, Bradesco, Itaú, Banco do Brasil, Santander and Caixa Econômica. Fraud attempts with the virus have increased in recent weeks, according to anti-fraud platform AllowMe. At least a thousand blows have already been carried out.

how does the virus work

BrasDex allows cybercriminals to recognize screen elements and typed data, manage to see balance and credentials. It is uploaded via emails, Whatsapp messages, shady websites asking for phishing apps to be installed, and SMS..

“When the account holder schedules an action through Pix and redirects it to one of their connections, a new screen appears to load, but this is actually a white mask behind which the criminal changes values ​​and recipients,” explained Fernando Guariento, Professional Services leader at AllowMe.

A short time later, the password is entered when the user confirms the transaction.. “But when the transfer is made and a receipt is given, he realizes that the money was going to someone else, often an orange that was shared by the gang,” Guariento concluded.