Loading story…
Researchers uncovered ParaSiteSnatcher, a malicious browser-extension framework targeting Google Chrome and other Chromium-based browsers to steal and manipulate sensitive data from users in Latin America, with a strong focus on Brazil. The malware monitors tabs, injects malicious scripts, intercepts user input, and captures POST requests before they are transmitted, allowing it to harvest banking and financial information tied to Banco do Brasil and Caixa Econômica Federal. It also steals Brazilian tax ID numbers and cookies, including Microsoft account cookies.
The framework was also built to interfere with Brazilian payment workflows, including PIX transfers and Boleto Bancario transactions, giving attackers a way to alter or abuse online payments. Researchers said the malware is delivered through a VBScript downloader hosted on Dropbox and Google Cloud, and observed three downloader variants that added stronger obfuscation, anti-analysis checks, and randomization. Before installation, the downloader verifies that Google Chrome is present and that the victim has a valid AppData path, indicating a targeted and evolving campaign.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers found that ParaSiteSnatcher is delivered through a VBScript downloader hosted on Dropbox and Google Cloud. They observed three downloader variants with progressively stronger obfuscation and anti-analysis features, including reverse-string obfuscation, junk code, anti-debugging, anti-tamper protections, and randomized names.
Trend Micro researchers identified a malicious browser extension framework named ParaSiteSnatcher that targets Google Chrome and other Chromium-based browsers, with a focus on users in Latin America, especially Brazil. The framework steals and manipulates sensitive data, including banking information, PIX and Boleto payment activity, Brazilian tax IDs, and cookies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported new **banking malware campaigns targeting Brazilian users and financial institutions**, with one operation focused on Android devices and Brazil's **Pix** instant payment ecosystem, and another aimed at Windows users of at least **33 Brazilian banks**. The Android trojan, dubbed **PixRevolution**, was identified by Zimperium as malware built to hijack mobile payments in real time, using a human operator to intervene at the moment of transaction and redirect funds. The campaign reflects the continued attractiveness of Brazil's heavily used digital payment environment to financially motivated attackers. A separate but related report described **VENON**, a **Rust-based** Windows banking trojan disclosed by ZenoX that uses banking overlays, active window monitoring, and `LNK` hijacking techniques associated with Latin American banking malware. Researchers said VENON is delivered through a multi-stage infection chain involving **DLL side-loading**, likely social engineering, and a PowerShell-based downloader, then applies anti-analysis measures such as **AMSI bypass**, **ETW bypass**, anti-sandbox checks, and indirect syscalls before contacting cloud infrastructure. One additional reference about malicious Rust crates targeting developer secrets is **not part of the same event**, as it concerns software supply chain theft rather than banking malware aimed at Brazilian financial users.
Jun 29, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026