Brazil malware swaps Pix QR codes in e-commerce

Operation timeline

Attack chain and TTPs

The chain described by the sources is an intrusion on the e-commerce site itself. In principle, this is not a compromise of the buyer’s device, but of the merchant’s payment page. When the customer selects Pix, the malicious script intervenes in the rendering of the QR Code and the Pix Copia e Cola field, replacing legitimate information with data controlled by the attacker.

That changes the detection problem. From the user’s perspective, the experience looks normal because the interface shows no visible changes. From the merchant’s perspective, the issue sits in the code loaded into the checkout, which in many cases is obfuscated, according to Folha de S.Paulo’s reference to a Kaspersky director. The report says the replacement is triggered by a strange piece of code, often written in obfuscated lines, which reinforces the hypothesis of frontend tampering or injection in the checkout script chain.

The same flow explains why a single compromised site can have broad impact. If a store receives many daily visits, each buyer is exposed at the exact moment of payment. TRBN sums it up well by saying the malware targets the e-commerce structure, not customer machines. The operational focus is the merchant’s server or web environment, not the user endpoint.

The sources also suggest a broader functional scope. Olhar Digital says the same code can copy credit card data processed at checkout. That fits a multipurpose skimming logic, where the attacker seeks value in different forms within the same payment page. The Magecart comparison made by eremit4 makes sense in that context, because it connects payment fraud and data capture.

Regional impact

Regional overview

The case has broad regional coverage in Brazilian media, but the verifiable impact in the sources is concentrated in Brazil. The campaign affects small and mid-sized stores, with a compromise pattern that hits the checkout experience and, by extension, anyone paying with Pix from those sites.

The most solid regional reading is operational, not geopolitical. There is no state attribution or public evidence of spread to other countries in the region in the available material. What does appear is an exportable risk, since the model, a checkout skimmer on an e-commerce platform, can be replicated in other markets with equivalent payment methods.

Brazil

Brazil is the only country with verifiable impact in the material and concentrates the discovery, validation, defensive response and official guidance. Folha de S.Paulo, UOL Tilt, O Tempo, Folha Vitória, Ground News, O Povo, TRBN, Olhar Digital and Procon-SP all agree on the same core facts: 90 compromised stores, mostly small and mid-sized, with Magento prevalent and sectors including optical shops, auto parts, fashion and online fundraising.

The most relevant vector is the silent replacement of the QR Code and Pix Copia e Cola during checkout. O Povo adds an important nuance, saying the legitimate QR code is replaced before it is shown on screen, without changing the page’s appearance. That reinforces the idea that the fraud relies on the user’s visual trust and on the legitimacy of the store URL or branding.

TRBN adds an infrastructure detail that does not appear in the other notes reviewed, six different command-and-control domains used to inject the malicious code. Although the material does not publish those domains, the detail suggests operational redundancy and a campaign with the ability to re-inject or maintain persistence across multiple sites. TRBN also stresses that the target is e-commerce, not the consumer’s device.

On mitigation, the consensus is clear. Merchants should update the platform, change admin passwords, use 2FA and monitor the site with security software. Users should validate the name, CNPJ and amount in the banking app before authorizing payment. If the transaction was diverted, the next step is to contact the bank and start MED, which according to Procon-SP now has a window of up to 80 days.

Technical indicators

No hashes, IPs or concrete domains were published in the notes reviewed. The only technical infrastructure detail identified in the material is TRBN’s mention of six command-and-control domains, without a public list or observable values.

Analysis for security teams

The immediate priority for an e-commerce team is to assume the problem lives in the checkout frontend, not only in the payment layer. That means reviewing script integrity, templates and extensions, especially on platforms like Magento, which appear repeatedly in the material. If the site uses third-party payment tools or embedded widgets, external dependencies and recent changes in the purchase flow should also be reviewed.

The lack of public IOCs limits signature-based detection. In that environment, practical defense comes down to three pillars. First, change control and integrity monitoring over checkout files. Second, review administrative accounts, with unique passwords and 2FA. Third, alerts for anomalous rendering of the QR code and Pix Copia e Cola, especially if they vary by device or session.

For operational monitoring, it makes sense to correlate checkout changes with spikes in disputes or customer complaints about paying the wrong recipient. There is no need to wait for a formal complaint to review the environment. If a store operates in Brazil and processes Pix, Procon-SP’s note about the MED window being extended to 80 days also suggests keeping a documented internal response process, because potential reimbursement does not replace containment and root-cause analysis.

For end users, the best guidance remains banking app verification. The sources agree that the recipient name and CNPJ must match the store or the payment intermediary. If the payment goes to an unknown individual or a different recipient, the purchase should stop. If the diversion has already happened, the bank must be contacted immediately to log the incident and activate MED.

Frequently asked questions

What do the sources combine about the scope and vector of the fraud?

The sources combine two data points: the scope measured by Kaspersky, which reaches 90 Brazilian stores, and the vector, a malware injected into checkout to replace the Pix QR code and Pix Copia e Cola. That combination makes this an e-commerce campaign, not an isolated incident.

What makes this case different from a common Pix fraud?

The difference is that the user enters a legitimate page and the change happens inside the store site at payment time. There is no crude spoofing of the interface. In addition, TRBN points to six C2 domains and Olhar Digital adds the possible copying of card data.

What signs can help detect it before confirming payment?

The practical signal is to check the recipient name, CNPJ and amount in the banking app before authorizing Pix. If the data do not match the store or its payment intermediary, the transaction should be stopped. That recommendation appears in Folha de S.Paulo, Folha Vitória and Procon-SP.

What should a Brazilian merchant do if compromise is suspected?

It should prioritize platform updates, changing administrative passwords, two-factor authentication and monitoring with security software. O Tempo and Olhar Digital add that on Magento, the checkout and dependencies should be reviewed regularly. The key is to treat it as a site compromise, not a customer problem.

What official option exists if the money already left incorrectly?

The sources recommend contacting the bank or payment institution immediately and requesting the Special Return Mechanism. Procon-SP says Brazil’s central bank extended the MED deadline from 30 to 80 days after the mistaken transfer, which expands the response window.

Is there attribution to a criminal group or a specific country?

No. The notes reviewed speak generically of criminals or scammers and do not attribute the campaign to an identified group or a state. They also do not publish hashes, concrete C2 domains or code samples, except for TRBN’s mention of six command-and-control domains.

Material limitations

The material does not allow identification of the malware authors, code families, hashes, IPs or concrete command-and-control domains. There is also no attribution to a criminal group or a country. The infrastructure cited by TRBN is limited to the number of C2 domains, without actionable indicators.

The journalistic sources reviewed focus on the fraud behavior, the approximate number of affected stores and mitigation guidance. They do not provide forensic evidence, malicious code captures or reverse-engineering analysis. For that reason, the technical reconstruction has to remain at the level of the campaign and observable TTPs from public coverage.

There are also no verifiable data showing impact outside Brazil. Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States and Uruguay have no confirmed facts in the available research. The regional reading, for now, is one of model exportability, not confirmed expansion.