Prilex

Prilex is a Brazilian cybercriminal threat actor and associated malware family focused on financial fraud against payment ecosystems. Active since at least 2014, the group first became known for ATM jackpotting operations in Brazil and later evolved into a modular point-of-sale malware operation targeting payment terminals and EFT/TEF environments. Prilex has been linked to large-scale ATM compromise, payment card data theft, and the cloning and fraudulent use of EMV chip-and-PIN cards. In its ATM phase, Prilex compromised bank environments, conducted internal reconnaissance, used default credentials for lateral movement, and deployed malware that patched legitimate ATM software to enable jackpotting. The malware also captured payment card data from cards used in infected machines. In its later PoS-focused phase, Prilex shifted to highly targeted intrusions rather than broad spam distribution, commonly relying on social engineering, including impersonation of technicians and abuse of remote-access software to gain entry and install malware. Prilex PoS malware targets Brazilian payment software and has progressed from software patching and memory scraping to more advanced interception of live payment flows. Observed capabilities include patching PoS components, hooking Windows APIs, intercepting communications between PoS software and PIN pads over serial interfaces, modifying transaction content in real time, and storing stolen transaction data in encrypted form prior to exfiltration. Recent variants have used a modular architecture with backdoor, stealer, and uploader components. A defining aspect of Prilex operations is abuse of weaknesses in EMV transaction implementations. Earlier activity used replay-style techniques, while later variants adopted so-called GHOST transactions that capture live transaction data and obtain fresh EMV cryptograms from victim cards for fraudulent purchases. Separate reporting has also tied Prilex to a card-cloning ecosystem that included malware on infected PoS terminals, a malicious Java applet for smart cards, and tooling used to write stolen payment data onto cards and facilitate fraudulent withdrawals and purchases. This tradecraft enabled bypass of optional EMV authentication and cardholder-verification steps in certain configurations, allowing cloned cards to be accepted without normal validation. Prilex is best characterized as a financially motivated Brazilian cybercriminal actor specializing in payment fraud, card theft, and post-compromise manipulation of payment transactions.