Loading story…
Check Point Research reported that PixStealer, an Android banking trojan, abuses the operating system's Accessibility Services to steal credentials and intercept financial activity on infected devices. The malware targets Brazil's instant payment ecosystem, particularly the Pix platform, and is designed to harvest sensitive banking information, manipulate on-screen activity, and facilitate fraudulent transactions by abusing permissions intended to assist users with disabilities.
The campaign reflects a broader evolution in mobile banking malware, with attackers relying on accessibility abuse to gain extensive control over victim devices, monitor apps, capture input, and bypass normal user protections. By focusing on a widely used real-time payment method and leveraging trusted Android features, PixStealer increases the risk of account takeover and unauthorized transfers for mobile banking users and financial institutions operating in the region.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published its analysis of PixStealer, describing it as a new wave of Android banking trojans abusing Android Accessibility Services. The reference indicates public disclosure of the malware campaign and its techniques on this date.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported new **banking malware campaigns targeting Brazilian users and financial institutions**, with one operation focused on Android devices and Brazil's **Pix** instant payment ecosystem, and another aimed at Windows users of at least **33 Brazilian banks**. The Android trojan, dubbed **PixRevolution**, was identified by Zimperium as malware built to hijack mobile payments in real time, using a human operator to intervene at the moment of transaction and redirect funds. The campaign reflects the continued attractiveness of Brazil's heavily used digital payment environment to financially motivated attackers. A separate but related report described **VENON**, a **Rust-based** Windows banking trojan disclosed by ZenoX that uses banking overlays, active window monitoring, and `LNK` hijacking techniques associated with Latin American banking malware. Researchers said VENON is delivered through a multi-stage infection chain involving **DLL side-loading**, likely social engineering, and a PowerShell-based downloader, then applies anti-analysis measures such as **AMSI bypass**, **ETW bypass**, anti-sandbox checks, and indirect syscalls before contacting cloud infrastructure. One additional reference about malicious Rust crates targeting developer secrets is **not part of the same event**, as it concerns software supply chain theft rather than banking malware aimed at Brazilian financial users.
Jun 29, 2026
Researchers reported that **ToxicPanda 2.0** has significantly expanded its Android banking trojan capabilities, targeting more than **140 banking and cryptocurrency apps** and using overlay attacks against **349 financial institutions in 16 countries**. The updated malware is designed to steal credentials and PINs, including device lock credentials, by presenting fraudulent screens over legitimate apps and harvesting sensitive input from victims. The malware also deepens persistence by abusing **Android Accessibility Service** to enable **wireless debugging**, interact with consent prompts, and gain shell-level access through the **Android Debug Bridge (ADB)** daemon. That combination allows attackers to grant broad permissions and maintain access to compromised devices even after initial infection, prompting defenders to prioritize controls such as blocking sideloading on managed devices, treating accessibility grants as privileged events, and alerting on developer options or wireless debugging being enabled.
Aug 28, 2026
Researchers identified a new **Svpeng** Android banking trojan variant, `Trojan-Banker.AndroidOS.Svpeng.ae`, that expanded the malware family’s capabilities by abusing Android accessibility services to capture keystrokes and other user activity. The malware can grant itself broad privileges, hinder removal, steal text entered into other applications, take screenshots, display phishing overlays on targeted apps, and receive commands from a command-and-control server. The campaign was observed in limited volumes across **23 countries**, with the largest shares in Russia, Germany, and Turkey, although the malware was designed not to run on devices using the Russian language setting. The sample was distributed through malicious websites posing as a fake **Flash Player** update, and researchers said the technique remained effective even against fully updated Android devices.
Aug 14, 2026