Zimperium\u2019s zLabs threat intelligence team has identified PixRevolution, a sophisticated Android banking trojan designed to hijack Brazil\u2019s PIX instant payment system in real time.<\/p>\n\n\n\n
The malware marks a new phase in mobile financial fraud by combining screen surveillance with operator-driven attacks that intervene during live transactions.<\/p>\n\n\n\n
Unlike traditional banking trojans that rely on automated overlays or credential harvesting, PixRevolution allows a human or AI operator to watch an infected device\u2019s screen as a payment occurs. When a victim initiates a PIX transfer the malware waits until the final confirmation stage before quietly modifying the recipient\u2019s PIX key.<\/p>\n\n\n\n
To the user the process appears normal. A brief loading screen appears while the malware replaces the intended recipient with an attacker-controlled account. The transaction then completes successfully but the funds are redirected instantly to the criminal.<\/p>\n\n\n\n
The malware is typically distributed through fraudulent app store pages that mimic legitimate services. Victims are persuaded to install a malicious Android application which then requests accessibility permissions under the pretense of enabling functionality. In reality these permissions provide full visibility into on-screen activity and allow the trojan to manipulate user input.<\/p>\n\n\n\n
PixRevolution also streams the victim\u2019s screen to a remote command and control server using Android\u2019s MediaProjection API. This enables attackers to monitor financial activity live and inject commands that alter payment details seconds before confirmation.<\/p>\n\n\n\n
Researchers warn the model could expand beyond Brazil as instant payment platforms grow worldwide. Security teams should monitor mobile threats targeting accessibility services and real time payment workflows closely.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Zimperium\u2019s zLabs threat intelligence team has identified PixRevolution, a sophisticated Android banking trojan designed to hijack Brazil\u2019s PIX instant payment system in real time. The malware marks a new phase in mobile financial fraud by combining screen surveillance with operator-driven attacks that intervene during live transactions. Unlike traditional banking trojans that rely on automated overlays […]<\/p>\n","protected":false},"author":58,"featured_media":19142,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71,51,89,3],"tags":[7445,7441,7444,7449,7450,7447,7448,7443,7442,7440,7446],"class_list":["post-19141","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-banking-finance","category-brazil","category-mobile","category-top-stories","tag-accessibility-permission-abuse","tag-android-banking-trojan","tag-android-financial-malware","tag-brazil-pix-security","tag-instant-payment-security","tag-mediaprojection-api-malware","tag-mobile-banking-threats","tag-mobile-malware-research","tag-pix-payment-fraud","tag-pixrevolution-malware","tag-zimperium-zlabs"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/posts\/19141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/comments?post=19141"}],"version-history":[{"count":2,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/posts\/19141\/revisions"}],"predecessor-version":[{"id":19145,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/posts\/19141\/revisions\/19145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/media\/19142"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/media?parent=19141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/categories?post=19141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/latam\/wp-json\/wp\/v2\/tags?post=19141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}