Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions

Gbhackers •Mayura Kathir • September 2, 2026

A financially motivated threat actor tracked as BREEZE COMET has breached Brazilian financial, retail, and eCommerce organizations, using privileged access to payment platforms to execute hundreds of fraudulent transactions in tightly timed waves. The activity overlaps with clusters publicly identified as Plump Spider and SHADOW-AETHER-064, although GTIG’s reporting frames this as operational overlap rather than […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Breeze Comet Targets Brazilian Financial Sector with Systemic Fraud Since 2024, the financially motivated threat actor Breeze Comet has targeted Brazilian financial services, retail, and eCommerce organizations, executing hundreds of fraudulent transactions via the Pix payment system. This group, previously known as UNC5669, employs tactics such as password spraying and social engineering to gain access to sensitive environments where payment orders are generated. Their operations have resulted in significant financial losses, with at least one heist amounting to tens of thousands of dollars. The group is known to exploit vulnerabilities in banking software and payment APIs, leveraging a customized malware suite and compromised websites for initial access. Recent reports indicate that Breeze Comet may be expanding its operations to other countries in Latin America and Africa. The overlap with other threat actors like Plump Spider highlights the complexity and interconnectedness of these cybercriminal activities. Organizations are urged to implement robust security measures to mitigate these evolving threats. 7 sources 70

Extracted Entities

Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Campaigns (1)

Industries (2)

MITRE ATT&CK (1)