{
  "name": "GoPix banking Trojan targeting Brazilian financial institutions",
  "slug": "gopix-banking-trojan-targeting-brazilian-financial-institutions",
  "description": "GoPix is an advanced persistent threat targeting Brazilian financial institutions and cryptocurrency users. It uses memory-only implants and obfuscated PowerShell scripts, evolving from previous RAT and ATS threats. The malware employs sophisticated techniques, including malvertising via Google Ads, man-in-the-middle attacks, and monitoring of Pix transactions and Boleto slips. GoPix bypasses security measures, maintains persistence, and uses robust cleanup mechanisms. It leverages multiple obfuscation layers and a stolen code signing certificate to evade detection. The threat actors carefully select victims, including financial bodies of state governments and large corporations, using legitimate anti-fraud services for targeted delivery.",
  "published": "2026-03-16T14:14:28+00:00",
  "created_at": "2026-03-16T14:14:28+00:00",
  "modified_at": "2026-03-16T17:54:40+00:00",
  "created_at_opencti": "2026-03-16T14:14:28+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-16",
    "banking trojan",
    "boleto",
    "brazil",
    "cryptocurrency",
    "gopix",
    "malvertising",
    "man-in-the-middle",
    "memory-only implant",
    "obfuscation",
    "pix",
    "powershell"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://correioez0ubcfht9i3.lovehomely.com/"
      },
      {
        "id": "",
        "name": "https://mydigitalrevival.com/get.php"
      },
      {
        "id": "",
        "name": "http://yogarecap.com/1/"
      },
      {
        "id": "",
        "name": "http://4a3d.com/1/"
      },
      {
        "id": "",
        "name": "http://9de1.com/1/"
      },
      {
        "id": "",
        "name": "http://ef0h.com/1/"
      },
      {
        "id": "",
        "name": "http://webmensagens4bb7.com/"
      },
      {
        "id": "",
        "name": "http://b3d0.com/1/"
      },
      {
        "id": "",
        "name": "https://correiotwknx9gu315h.lovehomely.com/"
      },
      {
        "id": "",
        "name": "7ee681e494d942d7dcc399f5f81fa48cad01e41742d1882790ad4d8d115e25ca"
      }
    ],
    "malware": [
      {
        "id": "3ae8649f-4242-4d04-b2eb-eff9a25bfc45",
        "name": "GoPix",
        "slug": "gopix"
      }
    ],
    "intrusion_sets": [
      {
        "id": "051aab92-48ba-4289-ab19-077707276646",
        "name": "GoPix",
        "slug": "gopix"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "mydigitalrevival.com"
      },
      {
        "id": "",
        "name": "webmensagens4bb7.com"
      },
      {
        "id": "",
        "name": "paletolife.com"
      },
      {
        "id": "",
        "name": "b3d0.com"
      },
      {
        "id": "",
        "name": "yogarecap.com"
      },
      {
        "id": "",
        "name": "ef0h.com"
      },
      {
        "id": "",
        "name": "correiotwknx9gu315h.lovehomely.com"
      },
      {
        "id": "",
        "name": "correioez0ubcfht9i3.lovehomely.com"
      },
      {
        "id": "",
        "name": "4a3d.com"
      },
      {
        "id": "",
        "name": "9de1.com"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/69b81e54cf83df8f4401d65d",
    "https://securelist.com/gopix-banking-trojan/119173/"
  ]
}