Threat intelligence blog · CTI LATAM https://cyberthreatintelligence.lat/en/blog/ CTI and OSINT notes on financial threats, malware and signals in Latin America. en Mon, 26 Oct 2026 15:16:05 +0000 contacto@cyberthreatintelligence.lat (Cyber Threat Intelligence LATAM) Desenrola Brasil: investigation into an active campaign https://cyberthreatintelligence.lat/en/blog/desenrola-brasil-investigacion-campana-activa/ https://cyberthreatintelligence.lat/en/blog/desenrola-brasil-investigacion-campana-activa/ Mon, 26 Oct 2026 15:16:05 +0000 Field investigation Five sites impersonating Desenrola Brasil: CPF lookup, simulated assistance and a PIX request for R$ 68,92. Evidence from October 25–26, 2026. Vaca Muerta Investment: the promise of 950 euros a day and its connection to the TALE-VAULT fraud infrastructure https://cyberthreatintelligence.lat/en/blog/vaca-muerta-investment-tale-vault/ https://cyberthreatintelligence.lat/en/blog/vaca-muerta-investment-tale-vault/ Mon, 19 Oct 2026 15:00:00 -0300 An independent investigation documents nine brands with a shared configuration and more than 3,500 entry and destination domains.

Read the full analysis

]]> “Verified identity”, misleading destination: how paid ads lead Argentine users to fake investments https://cyberthreatintelligence.lat/en/blog/cashcloak-verified-ads-fake-investments/ https://cyberthreatintelligence.lat/en/blog/cashcloak-verified-ads-fake-investments/ Field investigation Over two days of normal phone use I documented paid ads, with the advertiser identity verified by Google, that led to fake news articles, investment chatbots, phone-number capture and a form asking for the full card. It is not a gang: it is a traffic-acquisition circuit.

Read the full analysis

]]> AiTM and session theft: what the app token protects and what it does not https://cyberthreatintelligence.lat/en/blog/app-token-does-not-stop-session-theft-outside-region/ https://cyberthreatintelligence.lat/en/blog/app-token-does-not-stop-session-theft-outside-region/ Thu, 24 Sep 2026 15:00:00 -0300 Financial malware Distinguishing OTP codes, session cookies and real-time phishing: documented cases, defensive controls and limits of financial-sector evidence in LATAM.

Read the full analysis

]]> Balonx and BREEZE COMET: Customer and Institutional Fraud https://cyberthreatintelligence.lat/en/blog/balonx-breeze-comet-two-layers-banking-fraud-latam/ https://cyberthreatintelligence.lat/en/blog/balonx-breeze-comet-two-layers-banking-fraud-latam/ Mon, 21 Sep 2026 15:00:00 -0300 Financial malware A phishing-as-a-service in Mexico and an actor abusing privileged accounts in Brazil: two reports, two layers of the same banking fraud, with sources.

Read the full analysis

]]> Banking malware in LATAM: countries with data and coverage gaps https://cyberthreatintelligence.lat/en/blog/financial-malware-latam-countries-with-data-and-gaps/ https://cyberthreatintelligence.lat/en/blog/financial-malware-latam-countries-with-data-and-gaps/ Mon, 21 Sep 2026 15:00:00 -0300 Dataset & evidence Which countries appear in the LATAM banking-malware dataset, and where evidence is missing. September 2026 snapshots and limits of documentary counts.

Read the full analysis

]]> China–LATAM financial malware: four cases and their limits https://cyberthreatintelligence.lat/en/blog/china-latam-financial-malware-nexus/ https://cyberthreatintelligence.lat/en/blog/china-latam-financial-malware-nexus/ Mon, 21 Sep 2026 15:00:00 -0300 Dataset & evidence A source-based comparison of ToxicPanda, PlayPraetor, TgToxic and Darcula, separating regional evidence, language-based attribution and dataset limitations.

Read the full analysis

]]> PhaaS, Pix, authority lures and NFC with AI: four fraud hypotheses for 2027 https://cyberthreatintelligence.lat/en/blog/financial-fraud-latam-2027-scenarios/ https://cyberthreatintelligence.lat/en/blog/financial-fraud-latam-2027-scenarios/ Mon, 21 Sep 2026 15:00:00 -0300 Scenario / hypothesis Four 2027 hypotheses, each with an assumption, a signal to watch and today's evidence: PhaaS, Pix and Android, authority lures and NFC with AI in local tools.

Read the full analysis

]]> Grandoreiro after the 2024 operation: evidence from three vendors https://cyberthreatintelligence.lat/en/blog/windows-banking-trojans-grandoreiro-mekotio-tetrade/ https://cyberthreatintelligence.lat/en/blog/windows-banking-trojans-grandoreiro-mekotio-tetrade/ Mon, 21 Sep 2026 15:00:00 -0300 Financial malware A source-based reading of Grandoreiro, Mekotio and other Windows families in the LATAM Atlas, with the 2024 operation and dataset snapshots in context.

Read the full analysis

]]> Android Banking Malware in LATAM: Pix, NFC and PromptSpy https://cyberthreatintelligence.lat/en/blog/android-banking-malware-latam-pix-overlays/ https://cyberthreatintelligence.lat/en/blog/android-banking-malware-latam-pix-overlays/ Mon, 21 Sep 2026 15:00:00 -0300 Financial malware Android: 28 families. Patterns, Pix volume per the Central Bank of Brazil, NFC relay and PromptSpy, the first Android malware using generative AI.

Read the full analysis

]]> What a Financial Malware Dataset Must Guarantee to Be Citable https://cyberthreatintelligence.lat/en/blog/citable-financial-malware-dataset-guarantees/ https://cyberthreatintelligence.lat/en/blog/citable-financial-malware-dataset-guarantees/ Mon, 21 Sep 2026 15:00:00 -0300 Dataset & evidence Five guarantees a regional financial malware dataset needs to be citable: traceability, declared uncertainty, reproducible counts, dated updates and curation.

Read the full analysis

]]> Correo Argentino: six-signal cloaking and a chat requesting card details https://cyberthreatintelligence.lat/en/blog/correo-argentino-fraud-kit-cloaking-card-validation-bot/ https://cyberthreatintelligence.lat/en/blog/correo-argentino-fraud-kit-cloaking-card-validation-bot/ Wed, 02 Sep 2026 15:00:00 -0300 Field investigation Analysis of a Correo Argentino impersonation flow: six cloaking signals, a chat and the limits of inferred issuer-side card validation.

Read the full analysis

]]> “Argentina LNG” fraud using the YPF brand: observed campaign and a hypothesis of an international link https://cyberthreatintelligence.lat/en/blog/argentina-lng-ypf-fraud-international-cybercrime-network/ https://cyberthreatintelligence.lat/en/blog/argentina-lng-ypf-fraud-international-cybercrime-network/ Mon, 31 Aug 2026 15:00:00 -0300 Field investigation Field investigation into the “Argentina LNG” campaign: Google Ads malvertising, cloaking, 60+ co-hosted domains, vishing and a link to an international cluster.

Read the full analysis

]]> Alert: investment scam impersonating the President and YPF under the “Argentina LNG” brand https://cyberthreatintelligence.lat/en/blog/argentina-lng-alert-president-journalist-scam-still-active/ https://cyberthreatintelligence.lat/en/blog/argentina-lng-alert-president-journalist-scam-still-active/ Fri, 28 Aug 2026 15:00:00 -0300 Field investigation Alert on the “Argentina LNG” fraud campaign, active as of the publication date (August 28, 2026), using Google Ads, cloaking and a traffic distribution system (TDS). What to do and a summary of the technical evidence.

Read the full analysis

]]>