--- title: GoPix banking Trojan targeting Brazilian financial... description: Kaspersky GReAT researchers detail GoPix, an advanced banking Trojan targeting Brazilian financial institutions and cryptocurrency users. Active since at least... canonical: https://daily.dev/posts/gopix-banking-trojan-targeting-brazilian-financial-institutions-dnvrste8l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GoPix banking Trojan targeting Brazilian financial institutions | daily.dev og:description: Kaspersky GReAT researchers detail GoPix, an advanced banking Trojan targeting Brazilian financial institutions and cryptocurrency users. Active since at least... og:url: https://daily.dev/posts/gopix-banking-trojan-targeting-brazilian-financial-institutions-dnvrste8l og:image: https://api.daily.dev/og/posts/dNvrstE8l.png og:image:alt: GoPix banking Trojan targeting Brazilian financial institutions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GoPix banking Trojan targeting Brazilian financial institutions **[Securelist](https://daily.dev/sources/securelist)** · 12 min read · 0 upvotes · 0 comments ## Summary Kaspersky GReAT researchers detail GoPix, an advanced banking Trojan targeting Brazilian financial institutions and cryptocurrency users. Active since at least December 2022, GoPix spreads via Google Ads malvertising impersonating WhatsApp, Chrome, and other popular services. The malware uses memory-only implants, multi-stage obfuscated PowerShell scripts, and stolen code-signing certificates to evade detection. It performs man-in-the-middle attacks using Proxy AutoConfig (PAC) files combined with injected rogue root certificates to intercept HTTPS traffic on targeted banking sites. GoPix monitors and manipulates Pix transactions, Boleto slips, and cryptocurrency wallet addresses. It uses legitimate anti-fraud scoring services to pre-qualify victims and avoid sandboxes, employs very short-lived C2 infrastructure, and injects its payload into browser processes to intercept financial data while leaving minimal disk artifacts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Real-Time Banking Trojan Strikes Brazil's Pix Users](https://daily.dev/posts/real-time-banking-trojan-strikes-brazil-s-pix-users-fpy59x4iv) · Dark Reading · 0 upvotes · 0 comments - [Kaspersky financial threat report 2025](https://daily.dev/posts/kaspersky-financial-threat-report-2025-svaqauf36) · Securelist · 0 upvotes · 0 comments - [WhatsApp Malware 'Maverick' Hijacks Browser Sessions to Target Brazil's Biggest Banks](https://daily.dev/posts/whatsapp-malware-maverick-hijacks-browser-sessions-to-target-brazil-s-biggest-banks-gapnyijhe) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/gopix-banking-trojan-targeting-brazilian-financial-institutions-dnvrste8l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GoPix banking Trojan targeting Brazilian financial institutions","url":"https://daily.dev/posts/gopix-banking-trojan-targeting-brazilian-financial-institutions-dnvrste8l","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gopix-banking-trojan-targeting-brazilian-financial-institutions-dnvrste8l"},"datePublished":"2026-03-16T11:01:50.773Z","dateModified":"2026-03-16T11:02:31.692Z","description":"Kaspersky GReAT researchers detail GoPix, an advanced banking Trojan targeting Brazilian financial institutions and cryptocurrency users. Active since at least...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78f71e6aeee9d4ecbdb535f94ef9d190?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78f71e6aeee9d4ecbdb535f94ef9d190?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gopix-banking-trojan-targeting-brazilian-financial-institutions-dnvrste8l","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,powershell","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"GoPix banking Trojan targeting Brazilian financial institutions"}]} ```