CYBER THREAT INTELLIGENCE LATIN AMERICA · Strategic intelligence on digital financial fraud Read the blog
Independent editorial research · Latin America

Own dataset · data as of 2026-09-29

Financial threat map of Latin America

Which financial malware families the sources document in each country. Every data point links to a verifiable reference; the counts describe the dataset, not real prevalence.

View the map Request the reportRead the blog
families in the dataset
67

Families by platform

Android 31

AntidotAnubisBeatBankerBrasDexBRATACopybaraDevilNFCGhimobGigabudGoatRATGodfatherHerodotusHookHydraK99 Triumph CityMedusaNFCMultiPayNFU PayNGatePixBankBotPixPiratePixRevolutionPixStealerPromptSpyRocinanteSpyLoanSpyNoteToxicPandaTsarBotXenomorphZanubis

Windows and PoS/ATM 28

AmavaldoBanana RATBBTokBizarroBlind EagleCasbaneiroChavecloakCoyoteGoPixGrandoreiroGuildmaJanelaRATJaneleiroJavaliKREMLINLampionMekotioMispaduNFe-RATNumandoOkoBotPrilexSCMBANKERStarland RATTCLBANKERVadokristVenonWater Saci

PhaaS 8

Balonx SistemaDarculaGitBaitKit BDV multibancoLucidPhoenix SystemShadowParasiteVX-Pack

Open the family explorer →
institutional alerts
7

Alerts from public bodies

countries with documented families
9

Families per country

  • Brazil36
  • Mexico14
  • Peru7
  • Colombia6
  • Argentina4
  • Chile2
  • Venezuela2
  • Paraguay1
  • Costa Rica1

18 territories with no families in the dataset

ATT&CK techniques*
64

ATT&CK techniques used by the families

53 of 67 families have a profile with techniques · data as of 2026-09-29

  • T1417.002Input Capture: GUI Input Capture15
  • T1516Input Injection12
  • T1660Phishing10
  • T1566Phishing9
  • T1417Input Capture8
  • T1102Web Service7
  • T1219Remote Access Software6
  • T1513Screen Capture6
  • T1056Input Capture5
  • T1418Software Discovery4
  • T1636.004Protected User Data: SMS Messages4
  • T1105Ingress Tool Transfer3
  • T1115Clipboard Data3
  • T1189Drive-by Compromise3
  • T1406Obfuscated Files or Information3
  • T1437.001Application Layer Protocol: Web Protocols3
  • T1566.001Phishing: Spearphishing Attachment3
  • T1574.002Hijack Execution Flow: DLL Side-Loading3
  • T1027Obfuscated Files or Information2
  • T1027.001Obfuscated Files or Information: Binary Padding2
  • T1036Masquerading2
  • T1059.001Command and Scripting Interpreter: PowerShell2
  • T1059.005Command and Scripting Interpreter: Visual Basic2
  • T1071Application Layer Protocol2
  • T1185Browser Session Hijacking2
  • T1204.002User Execution: Malicious File2
  • T1218System Binary Proxy Execution2
  • T1417.001Input Capture: Keylogging2
  • T1430Location Tracking2
  • T1534Internal Spearphishing2
  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys2
  • T1566.002Phishing: Spearphishing Link2
  • T1568.002Dynamic Resolution: Domain Generation Algorithms2
  • T1614.001System Location Discovery2
  • T1633Virtualization2
  • T1636.003Protected User Data: Contact List2
  • T1053.005Scheduled Task1
  • T1055Process Injection1
  • T1056.001Input Capture: Keylogging1
  • T1082System Information Discovery1
  • T1110Brute Force1
  • T1113Screen Capture1
  • T1114.001Email Collection: Local Email Collection1
  • T1200Hardware Additions1
  • T1218.007System Binary Proxy Execution: Msiexec1
  • T1426System Information Discovery1
  • T1476Deliver Malicious App1
  • T1496Resource Hijacking1
  • T1497Virtualization1
  • T1497.001Virtualization1
  • T1499Endpoint DoS1
  • T1550Use Alternate Authentication Material1
  • T1555Credentials from Password Stores1
  • T1555.003Credentials from Web Browsers1
  • T1557Adversary-in-the-Middle1
  • T1564Hide Artifacts1
  • T1567Exfiltration Over Web Service1
  • T1598Phishing for Information1
  • T1625Hijack Execution Flow1
  • T1629.002Impair Defenses1
  • T1630Account Access Removal1
  • T1636.001Protected User Data: Calendar Entries1
  • T1636.002Protected User Data: Call Logs1
  • T1646Exfiltration Over C2 Channel1

* Descriptive analysis with data as of 15 September: 64 distinct techniques and 171 family–technique pairs.

What the dataset documents

Dataset figures as of the data date. They are not field prevalence, a risk ranking or a volume of observed incidents.

Android

31 families

Mobile banking trojans, overlays, NFC relay and Pix stealers.

Documented families · 31

AntidotAnubisBeatBankerBrasDexBRATACopybaraDevilNFCGhimobGigabudGoatRATGodfatherHerodotusHookHydraK99 Triumph CityMedusaNFCMultiPayNFU PayNGatePixBankBotPixPiratePixRevolutionPixStealerPromptSpyRocinanteSpyLoanSpyNoteToxicPandaTsarBotXenomorphZanubis

Countries with most families

  • Brazil13
  • Peru4
  • Colombia2
  • Argentina1
  • Mexico1

A count of what is documented, not prevalence.

See these 31 in the explorer →

Windows / PoS

28 families

Desktop banking trojans, toolkits and point-of-sale malware.

Documented families · 28

AmavaldoBanana RATBBTokBizarroBlind EagleCasbaneiroChavecloakCoyoteGoPixGrandoreiroGuildmaJanelaRATJaneleiroJavaliKREMLINLampionMekotioMispaduNFe-RATNumandoOkoBotPrilexSCMBANKERStarland RATTCLBANKERVadokristVenonWater Saci

Countries with most families

  • Brazil22
  • Mexico10
  • Argentina3
  • Chile2
  • Colombia2

A count of what is documented, not prevalence.

See these 28 in the explorer →

PhaaS

8 families

Phishing-as-a-service, smishing/RCS and AiTM infrastructure.

Documented families · 8

Balonx SistemaDarculaGitBaitKit BDV multibancoLucidPhoenix SystemShadowParasiteVX-Pack

Countries with most families

  • Mexico3
  • Colombia2
  • Brazil1
  • Costa Rica1
  • Peru1

A count of what is documented, not prevalence.

See these 8 in the explorer →

CERTs and regulators

7 alerts

Institutional alerts; they are not malware families.

Alerts from public bodies

Limitations

This map starts from an own dataset, curated by hand for Latin America and the Caribbean, with verifiable references. It measures what is documented; it does not measure how much malware there is in the region.

01

It is not prevalence

The counts are the dataset's as of the data date. They are not a risk ranking by country or by family.

02

Absence ≠ zero threat

Countries without evidence are marked as coverage gaps, not as clean territory.

03

A mention does not prove victims

A country cited in the sources does not imply there are victims there. And the size of a count depends on the available literature: Brazil concentrates most of the public documentation.

04

Official alerts do not measure volume

Alerts from CERTs and regulators anchor the institutional voice; they measure neither volume nor coverage.

Map by country

Select a country to see the documented families. The color shows how many families mention the country in their sources, not how much activity there is.

Families mentioning the country
  • Gap · under investigation
  • 1–2
  • 3–5
  • 6–10
  • 11 or more
  • Institutional alerts only

Country by country

The full map as text: countries with documented families and those with institutional alerts only.

Brazil 36 documented families

PixPirate BrasDex PixBankBot PixStealer Ghimob GoatRAT Herodotus NGate NFCMultiPay PixRevolution Gigabud K99 Triumph City NFU Pay Mekotio Casbaneiro Guildma Javali Mispadu Numando Amavaldo Vadokrist Janeleiro Coyote Prilex Lampion BBTok JanelaRAT Chavecloak TCLBANKER NFe-RAT Water Saci Venon KREMLIN OkoBot Banana RAT VX-Pack

Mexico 14 documented families

Gigabud Grandoreiro Mekotio Casbaneiro Mispadu Numando Amavaldo BBTok JanelaRAT SCMBANKER OkoBot Balonx Sistema GitBait Kit BDV multibanco

Colombia 6 documented families

Gigabud K99 Triumph City Casbaneiro Blind Eagle Kit BDV multibanco ShadowParasite

Argentina 4 documented families

PromptSpy Casbaneiro Bizarro Blind Eagle

Venezuela 2 documented families

Starland RAT Kit BDV multibanco

Paraguay 1 documented family

Ghimob

Costa Rica 1 documented family

Kit BDV multibanco

Coverage gaps · under investigation

Latin American and Caribbean countries with no documented evidence so far: they are not "clean territory"; they are gaps in the available sources. They are under investigation.

BahamasBelizeBoliviaCubaEcuadorEl SalvadorGuatemalaGuyanaHaitiHondurasNicaraguaPanamaPuerto RicoSurinameTrinidad and TobagoUruguay

Four fronts of the dataset

The dataset is organized into Android, Windows and PoS, PhaaS and institutional alerts. Each front has an extended read on the blog.

Android

Mobile banking trojans, overlays, NFC relay and Pix stealers. Includes Zanubis, Medusa, NGate, Copybara and Herodotus.

Read: overlays and Pix →

PhaaS · AiTM

Phishing-as-a-service platforms and kits: Balonx Sistema, GitBait, Lucid and Darcula.

See the report →

CERTs · Regulators

Alerts from public bodies: CSIRT Chile/ANCI, CNSD Peru, Dominican Republic Superintendency of Banks and JaCIRT Jamaica.

See the coverage gaps →

Report 2023–2026

Three years of financial threats in Latin America. The four-page report is free to read; the full study is delivered on institutional request.

See the report →

Strategic intelligence on digital financial fraud

This publication follows how threats against banks, fintechs and financial users in Latin America are evolving and what changes for those who decide: regional patterns, the limits of the evidence and scenarios. The blog gathers source-dated analyses; there is also an RSS feed and the author's professional profile on LinkedIn.

Blog

Analysis with a source and a date behind every claim.

→

RSS

Feed subscription so you do not miss new posts.

→

LinkedIn

Professional profile of Ezequiel Jorge La Terra.

→

Frequently asked questions

How to read this dataset and this map.

What is Cyber Threat Intelligence LATAM?

It is independent strategic financial threat intelligence for Latin America: banking malware, PhaaS and fraud, with verifiable sources and a named author. It shows what changes in the ecosystem for those who make decisions; it is not a monitoring service or a live feed.

Who signs this research?

Ezequiel Jorge La Terra, the responsible author. The profile, the scope of the role and what the byline does not guarantee are on the author page.

Does the dataset measure how much malware there is in the region?

No. It is a curated dataset. The counts describe what the sources document with data as of 2026-09-29; absence from the dataset ≠ absence of threat.

What does it mean when a country is colored on the map?

That at least one family in the dataset mentions that country in the cited sources. The more families mention it, the more intense the color. It measures neither victims nor activity. Countries with no color are coverage gaps.

Why are some countries without data?

Because the available verifiable sources do not document them so far. It is a coverage gap, not a sign of safety, and those countries are under investigation.

How do I request the report or make an enquiry?

The report page has the free-to-read PDF report; the full study is requested from that same page. Enquiries and collaboration go through the contact page or by email to contacto@cyberthreatintelligence.lat.

Related reports and analysis

Find the context, sources and limits of these threats in the reports and articles on this site. For complementary reading, see the CASHCLOAK LATAM field investigation, with its own scope and observation period.

Read the reports Read the analysis