Desenrola Brasil: investigation into an active campaign
Five available hostnames, CPF lookup, simulated assistance and a request for R$ 68.92 via PIX: the chain documented in the code.
cyberthreatintelligence.lat · EDITORIAL RESEARCH
Strategic intelligence on digital financial fraud in Latin America
Cyber Threat Intelligence LATAM investigates digital financial fraud in Latin America: malware, BEC, PhaaS, ransomware, MitM, AiTM, voice and video deepfakes, KYC fraud and behavioral biometrics. We rely on our own dataset, hand-curated and analyzed with data science, and on field investigations with verifiable references. We always distinguish between what is documented and what actually circulates.
Independent research on digital financial fraud in Latin America. Reports and analysis with verifiable sources, ready to read and consult.
Open research
Every claim carries its source.
Check it yourself.
Cyber Threat Intelligence LATAM shows how it builds a regional reading before asking for trust: technical sources, public alerts and visible limits. The summary lets you review the criteria; the full report is delivered on request.
The method, with a case
How a 2026 case is read: SLIM SPIDER and Pix from the cloud.
A 2026 finding, step by step: what is recorded, what it is cross-checked against and what is left unclaimed.
- Record
CrowdStrike, Threat Hunting Report 2026: in late March 2026, OverWatch observed SLIM SPIDER, a Brazil-based eCrime group, in a multi-stage intrusion at a Brazilian financial institution, aimed at its crypto assets and instant-payment accounts. Credentials were obtained with Bash scripts that queried the cloud metadata service, and the exposed panel showed compromised hosts from several Brazilian banks and fintechs. Source, date and what it claims are recorded; the report does not describe how initial access was gained.
- Cross-check
BioCatch (2026) describes another blind spot in the region: the account that receives the money is among the least analysed in prevention models. Darktrace (2026) documents Water Saci, another Brazilian group, which uses WhatsApp against financial institutions and crypto exchanges. These are different angles: neither confirms the CrowdStrike case on its own.
- Set limits
It is stated that CrowdStrike observed this intrusion in March 2026 and that it targeted crypto assets and instant-payment accounts. It is not stated how much money was taken, how many institutions suffered losses, how initial access was gained, or that the same group is behind other incidents: there is a single source.
How a source is read: the Grandoreiro case.
The same finding as above, step by step: what is recorded, what it is cross-checked against and what is left unclaimed.
- Record
INTERPOL, 18 March 2024: five administrators arrested in Brazil in January 2024. Source, date and what it claims are recorded: arrests, not the end of the operation.
- Cross-check
Kaspersky (October 2024), IBM X-Force and ESET (June 2025) document later activity: three vendors, three different sets of telemetry.
- Set limits
It is stated that there was activity after the operation. It is not stated how many victims there are or in which country it weighs most.
Regional evidence
Where published sources exist by country — and where the map is still blank.
Explore the map ↗Family explorer
LATAM Atlas families, filterable by platform and country. Dataset counts, not prevalence.
Open the explorer ↗Report 2023–2026
Free reading of the study. The full report is delivered on request.
Read the report ↗Institutional enquiry
Banks, CERTs and fraud teams: context, collaboration or access to the material.
Write ↗Blog in motion
Research does not end when an alert is published.
Each card opens a public read from the blog: techniques, campaigns, limits and questions that remain open in the regional financial ecosystem.
Blog
Latest publications
Omegatech: Seychelles, fraud infrastructure and the connection to TALE-VAULT
An investigation into Omegatech: Seychelles, malware, abuse notices, infrastructure reputation and four documented chains connected to TALE-VAULT.
Vaca Muerta Investment and TALE-VAULT: what links nine brands and where the evidence stops
An offer aimed at Germany that uses an Argentine reference leads to the TALE-VAULT infrastructure: nine brands sharing the same template and 3,622 domains observed between September 6 and October 6, 2026. The note separates what is documented from what the evidence does not support.
“Verified identity”, misleading destination: how paid ads lead Argentine users to fake investments
Over two days of normal phone use I documented paid ads, with the advertiser identity verified by Google, that led to fake news articles, investment chatbots, phone-number capture and a form asking for the full card. It is not a gang: it is a traffic-acquisition circuit.
AiTM and session theft: what the app token protects and what it does not
AiTM can capture credentials and also the authenticated session. This note separates OTPs, session cookies and interactive phishing; regional conclusions are limited to the sources reviewed.
Report library
Every report, in one place
CTI-LATAM-2026-001 · TLP:CLEAR
CASHCLOAK LATAM
Verified ads, destinations that do not match.
Paid ads with the advertiser identity verified by Google led Argentine users to fake investment articles, chatbots carrying the Mercado Libre brand and a form that asks for the full card with its security code. It is not a gang: it is a traffic market.