October 26, 2026 · Independent investigation
Desenrola Brasil: investigation into an active campaign
Five available hostnames, CPF lookup, simulated assistance and a request for R$ 68.92 via PIX: the chain documented in the code.
October 19, 2026 · Independent investigation
Vaca Muerta Investment: the promise of 950 euros a day and its connection to the TALE-VAULT fraud infrastructure
An independent investigation documents nine brands with a shared configuration and more than 3,500 entry and destination domains.
Cyber Threat Intelligence LATAM / regional observation · RSS available
Blog: strategic intelligence on digital financial fraud in Latin America
Field notes on threat intelligence, financial malware and OSINT in Latin America: signals, context and method for reading the regional ecosystem.
Desenrola Brasil: investigation into an active campaign
Five available hostnames, CPF lookup, simulated assistance and a request for R$ 68.92 via PIX: the chain documented in the code.
“Verified identity”, misleading destination: how paid ads lead Argentine users to fake investments
Over two days of normal phone use I documented paid ads, with the advertiser identity verified by Google, that led to fake news articles, investment chatbots, phone-number capture and a form asking for the full card. It is not a gang: it is a traffic-acquisition circuit.
AiTM and session theft: what the app token protects and what it does not
Distinguishing OTP codes, session cookies and real-time phishing: documented cases, defensive controls and limits of financial-sector evidence in LATAM.
Balonx and BREEZE COMET: Customer and Institutional Fraud
A phishing-as-a-service in Mexico and an actor abusing privileged accounts in Brazil: two reports, two layers of the same banking fraud, with sources.
Banking malware in LATAM: countries with data and coverage gaps
Which countries appear in the LATAM banking-malware dataset, and where evidence is missing. September 2026 snapshots and limits of documentary counts.
China–LATAM financial malware: four cases and their limits
A source-based comparison of ToxicPanda, PlayPraetor, TgToxic and Darcula, separating regional evidence, language-based attribution and dataset limitations.
PhaaS, Pix, authority lures and NFC with AI: four fraud hypotheses for 2027
Four 2027 hypotheses, each with an assumption, a signal to watch and today's evidence: PhaaS, Pix and Android, authority lures and NFC with AI in local tools.
Grandoreiro after the 2024 operation: evidence from three vendors
A source-based reading of Grandoreiro, Mekotio and other Windows families in the LATAM Atlas, with the 2024 operation and dataset snapshots in context.
Android Banking Malware in LATAM: Pix, NFC and PromptSpy
Android: 28 families. Patterns, Pix volume per the Central Bank of Brazil, NFC relay and PromptSpy, the first Android malware using generative AI.
What a Financial Malware Dataset Must Guarantee to Be Citable
Five guarantees a regional financial malware dataset needs to be citable: traceability, declared uncertainty, reproducible counts, dated updates and curation.
Correo Argentino: six-signal cloaking and a chat requesting card details
Analysis of a Correo Argentino impersonation flow: six cloaking signals, a chat and the limits of inferred issuer-side card validation.
“Argentina LNG” fraud using the YPF brand: observed campaign and a hypothesis of an international link
Field investigation into the “Argentina LNG” campaign: Google Ads malvertising, cloaking, 60+ co-hosted domains, vishing and a link to an international cluster.
Alert: investment scam impersonating the President and YPF under the “Argentina LNG” brand
Alert on the “Argentina LNG” fraud campaign, active as of the publication date (August 28, 2026), using Google Ads, cloaking and a traffic distribution system (TDS). What to do and a summary of the technical evidence.
Email subscription
When a new note comes out, I send you an email. No promotions and no sharing of your address.
Thank you, you are on the list. I will let you know when a new note comes out.