Reading contents
What the Android front measures
This article asks which techniques are documented in the Atlas Android records, not how many phones are infected. The 17 September 2026 snapshot contains 28 families, including PixPirate, BRATA, BrasDex, Godfather, Zanubis, Medusa, NGate, Copybara, Hook and Xenomorph.
The total is a documentary inventory, not a victim sample. The 29 September update records 31 Android families within 67 families overall. This reading retains the earlier 28-family snapshot and presents the later version separately. Country coverage and its limitations explain why neither count measures regional prevalence.
Recurring patterns
- Overlays: the historical analysis records MITRE ATT&CK Mobile T1417.002 in 15 of the 28 records. This is a frequency within the records, not an attack rate.
- Accessibility abuse: sources describe permissions used to read interfaces, intercept interactions or automate transfers. Not every capability is attributed to every family.
- Clipboard data and Pix keys: interest in copied payment-related data is distinguished from credential capture and screen control.
- Distribution outside app stores: the corpus includes APK delivery through messages, smishing or download components. This does not establish one universal infection route.
- NFC relay: the cited subset contains NGate, NFCMultiPay and DevilNFC. Its mechanism must not be extended to all Android malware.
Why Pix matters
The payment context comes from a different source than the malware inventory: the Relatório de Gestão do Pix 2023-2025 cited in the original article. The historical figures reproduced there are 79.8 billion transactions during 2025, 25.7% growth over 2024 and value exceeding R$35 trillion.
The cited snapshot also records 313,339,328 transactions on 5 December 2025, 148 million individuals and 12 million businesses that had used Pix by December of that year, and more than 920 million registered keys. These figures retain their original attribution and date; they are not updated or recalculated from the PDF.
The editorial interpretation is that the channel’s scale helps explain its economic appeal. It does not establish the proportion of fraudulent payments. Family names do not establish ancestry either: PixPirate, PixBankBot, PixStealer and GoPix—the last in the Windows/PoS group—need their own supporting references.
Pix contactless payments and NFC
The original article dates the formal addition of contactless payments to the Pix Regulation to June 2025: initiating a payment by bringing a phone near an NFC terminal. That regulatory context is retained with its attribution to the central bank report, pending a dedicated documentary check.
The existence of contactless Pix and NFC-relay entries in the corpus does not prove an attack against that Pix payment method. They are separate facts. The China–LATAM documentary comparison offers a different reading with its own reservations; it is not used here to attribute infrastructure or fill that evidence gap.
PromptSpy: generative AI and observation limits
ESET’s analysis, published on 19 February 2026, describes PromptSpy as the first Android malware known to its researchers to use generative AI in its execution flow. Gemini guides persistence in recent apps; the malware also includes VNC remote access and anti-uninstallation mechanisms.
The geographic qualification matters: ESET identifies indications of targeting Argentina but states it had not observed PromptSpy in its telemetry and considers a possible proof of concept. That does not establish a confirmed infection wave across LATAM or make every function AI-powered.
Names and relationships
Use the individual records and the Atlas alias table to normalise names. Recorded relationships, such as Hook/Ermac and Godfather/Anubis, remain attributed to their sources. A shared word, platform or financial target is insufficient to merge families, campaigns or operators.
The 17 September snapshot concentrates literature on Brazil, mentioned in 29 of the corpus’s 56 families. It does not measure country prevalence. Rereading ESET clarifies one observation limit for PromptSpy; it does not validate every Atlas figure or relationship.
On 29 September 2026, the Android front contains 31 of 67 families. The historical 28-family analysis remains separate. A dataset date does not automatically become the article’s modification date.
Version note: the figures in this analysis reflect the dataset cut-off in effect at the time of publication; the Atlas is updated continuously.
Ezequiel Jorge La Terra · ORCID 0009-0008-1677-4218 · Text licensed under CC BY 4.0.
How to cite: La Terra, E. J. (2026). Android Banking Malware in LATAM: Pix, NFC and PromptSpy. Cyber Threat Intelligence LATAM. Updated Sep 21, 2026. https://cyberthreatintelligence.lat/en/blog/android-banking-malware-latam-pix-overlays/
Get new notes by email
When a new note comes out, I send you an email. No promotions and no sharing of your address.
Thank you, you are on the list. I will let you know when a new note comes out.