New Virus Targets Brazilian E-commerce by Manipulating Pix Payments

A new type of virus is targeting Brazilian e-commerce sites by imperceptibly altering Pix QR codes and Copy and Paste codes during the payment process. According to security firm Kaspersky and independent researcher eremit4, the malware replaces the original payment code with a fraudulent one, diverting funds directly to the accounts of scammers. The virus specifically targets small and medium sized online stores using the free platform Magento, with Kaspersky detecting 90 infected sites in Brazil.

Fabio Assolini, a director at Kaspersky, stated that the potential for damage is high because the virus infects the website rather than the user's computer. This method leaves no visual trace for the customer. Additionally, the malware can steal credit card data for future cloning if the customer chooses that payment method instead of Pix. In such cases, the merchant still receives the payment, but the customer is defrauded later.

To protect themselves, buyers are advised to verify the recipient's name before confirming a Pix transaction and to use virtual credit cards. Merchants are encouraged to keep Magento updated, use complex administrative passwords, and monitor for anomalous behavior. While the Central Bank recommends the Special Return Mechanism (MED) to track fraudulent transactions, Assolini noted that scammers often distribute stolen funds across dozens of shell accounts within hours to bypass the system's five transfer tracking limit.

Both reports provided identical technical details and warnings, presenting the event as a cybersecurity threat without differing political framing.