Back Finextra

New banking trojan targets PIX payments in Brazil

Finextra • March 11, 2026

Today, Zimperium’s zLabs threat intelligence team, released its findings on a new Android banking trojan, dubbed PixRevolution, designed specifically to hijack Brazil’s PIX instant payment system, enabling attackers to divert funds during a transaction in real time.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PixRevolution Malware Targets Brazil's PIX Payment System in Real Time Zimperium's zLabs has identified a new Android banking trojan named PixRevolution, specifically designed to hijack Brazil's PIX instant payment system. This malware exploits the rapid and irreversible nature of PIX transactions, which have over 150 million users and process more than 3 billion transactions monthly. PixRevolution operates by monitoring victims' smartphones in real time, replacing the recipient's payment key with one controlled by attackers during the transaction. The malware remains dormant until a PIX transfer is initiated, displaying a fake loading screen to cover its malicious activities. Attackers distribute the malware through fraudulent Google Play Store pages that mimic legitimate apps. The trojan requires users to grant extensive accessibility permissions, allowing it to read screen content and simulate taps. The threat is significant due to the high volume of transactions and the lack of chargeback options for victims. 6 sources 69

Extracted Entities

New banking trojan targets PIX payments in Brazil

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

Platforms (1)