Banking scam: Brazil leads fraud and exports viruses – 08/25/2023 – Tech

Cybercriminals have automated mobile banking scams in Brazil based on espionage techniques. With the strategy, local fraudsters can scale financial gains in the country that is already a champion in fraud against individuals, according to the cybersecurity company Kaspersky.

The novelty is the Pix bypass scam, called in the jargon of ATS (automatic transfer system, in free translation).

This malicious program (malware) manages to change the recipient of an instant payment in a bank application before the user enters the access password without the need for a direct operation by the criminal.

The virus category in which Brazil leads is known as a “banking trojan”. Kaspersky registered 1.2 million of these malicious programs for Android phones in the country in the last 12 months. iPhone devices are also vulnerable to threats, albeit on a smaller scale.

In this area of ​​crime, Brazilians export to Latin America and even Australia viruses that attack bank applications.

Until 2022, the most common scam in smartphone banking apps was the “ghost hand”, where criminals run banking apps in the background while the smartphone screen is dark. The operation mode is similar to remote access used by technical assistance.

With ATS, the same cracker — the name adopted for a hacker who commits a crime — can execute several attacks at once and optimize gains, says Kaspersky senior analyst Fabio Marenghi.

This new strategy may compensate for the lower profitability of Brazilian cybercriminals in relation to their international peers, who prefer ransomware —a type of attack characterized by the kidnapping of a company’s virtual operations and sensitive data for a ransom demand.

JBS, for example, paid US$ 11 million (about R$ 55 million) to scammers, when it was the victim of ransomware in factories in the United States and Canada.

Brazilian crackers are shortsighted, which is why they specialize in more specific frauds, says the director of Kaspersky’s research team in Latin America, Fabio Assolini.

Planning a ransomware attack can take months of spying and analysis looking for a breach and can cost many thousands of dollars.

Ransomware offensives were also registered in Brazil by Kaspersky, in a smaller number — 603 thousand.

In most cases, criminals use malware developed abroad and made available in open source communities. Criminals often find vulnerabilities in outdated machines and systems within the network.

The BRB bank was one of the companies victimized by these attacks in October last year and received a R$ 5.2 million ransom request.

Trojan viruses against personal computers are still the most recurrent attacks in the country, with 1.877 million occurrences detected by Kaspersky.

The number of detections of these malicious programs grew by 32% between August 2022 and July 2023, compared to the previous 12 months. Among the 12 most common viruses in Latin America, seven came from Brazilian developers.

The focus of Brazilian cybercriminals on personal computers runs counter to the national preference for mobile banking —the use of smartphone banking services.

Cell phones accounted for 66% of banking transactions in 2022, according to the 2023 Febraban Banking Technology survey. Computers represent 14% of this total.

Infecting smartphones with malicious code is more difficult, as the operating systems on these devices give users less freedom to install programs and make customizations.

Digital fraudsters are still adapting to mobile operating systems, says Kaspersky security analyst Anderson Leite.

It’s been 23 years since Brazilian cybercriminals accumulated experience in banking trojans, says the analyst. One example of this expertise is the GuildMa malware, developed in 2015, which went beyond Latin America and reached Australia, Japan and Taiwan.

The program started to be functional in English and is already in at least 16 countries.