Table of Contents
This post is an executive summary of our latest threat intelligence. For the complete technical breakdown, IoCs, and MITRE ATT&CK mapping, [download the full report in English or Portuguese]
In Brazil, two things unlock almost everything financial. The first is the CPF, the national tax ID that now doubles as a digital identity. The second is Pix, the Central Bank’s instant payment system, which moves money in seconds, around the clock, with no way to pull it back. Together they’ve made Brazil one of the most digitized financial markets in Latin America. They’ve also handed fraudsters a near-perfect toolkit.
For nearly a year, Lumu’s Cyber Threat Intelligence (CTI) team has tracked a phishing operation built to exploit exactly that. It impersonates the Brazilian government, the Central Bank, and popular neobanks, and promises victims thousands in forgotten refunds or pre-approved loans. Then it asks for a small fee to release the money, typically worth just a few US dollars.
The money never arrives. The fee lands instantly in an attacker-controlled account, and the victim’s personal data is harvested for resale. Repeat that across hundreds of domains and thousands of victims, and you get a scam factory built to stay under every alarm the banking system has. The most effective fraud doesn’t look like fraud. It looks like a processing fee.
Quick Facts: The Pix-Fueled Scam Factory
|
What Is the Micro-Fraud Operational Model?
The traditional fraud playbook goes big: drain an account, trigger a bank alert, and the operation is burned. This campaign flips that logic. It trades the size of each payout for sheer victim volume, and the small amounts give attackers three advantages at once:
- A victim promised R$ 5,960.50 barely thinks twice about an R$ 86.63 fee. It’s under 1.5% of the prize.
- Micro-transactions sit below the thresholds that banking anti-fraud engines are tuned to catch.
- Few people file a police report over R$ 30. Every unreported case is one less signal for defenders.
No single transaction looks like a crime. The profit is in the aggregate.
How Does the Scam Kill Chain Work?
Lumu CTI identified three distinct phishing kits targeting different entities, but they all share a consistent and highly automated attack lifecycle:
- The Hook and Data Harvest: Victims are directed to a phishing site offering a financial benefit, such as forgotten tax funds (Sistema de Valores a Receber) or a fast-tracked loan. The site demands the victim’s CPF as an access control method.
- Contextual Enrichment: Upon entering the CPF, the malicious portal queries an automated data service to retrieve the victim’s full name, date of birth, and mother’s name.
- Trust Consolidation: The attackers use this personal data alongside aggressive psychological manipulation. Government-themed lures display fake institutional videos, automated chats with audio instructions, and fabricated comments from successful “beneficiaries”. Banking-themed lures use pre-qualification forms and 10-minute countdown timers to simulate credit analysis and manufacture urgency.
- Instant Monetization: To release the promised funds, the site demands an immediate administrative fee via a Pix QR code. The money is instantly routed into attacker-controlled accounts.
Two live samples show how lopsided the math is:
| Impersonated brand | What the victim is promised | What the victim pays |
| Gov.br / Central Bank (SVR) | R$ 5,960.50 in unclaimed funds | R$ 86.63 “withdrawal tax” |
| Nubank | R$ 9,978.00 pre-approved loan | R$ 28.93 administrative fee |
The fake Valores a Receber chat promises R$ 5,960.50 and asks the victim to confirm their mother’s name, which the kit already pulled from their CPF.
The cash-out: an R$ 86.63 “withdrawal tax” via Pix, with the victim’s own details on screen and a countdown to pay.
The Nubank lure: loans up to R$ 15,000, approved in 10 minutes, no credit check.
The Nubank checkout: an R$ 28.93 fee and a QR code that expires in minutes.
Are These Isolated Incidents or a Coordinated Network?
Lumu’s investigation confirms this is a unified, highly coordinated operation. Analysis of both the government and commercial phishing branches revealed critical operational overlaps.
When Lumu followed the money, the government-themed and Nubank-themed checkouts paid out to the exact same registered beneficiary, a business listed as “PLITUNI INTERMEDIACAO DE.” Both branches also generated their dynamic Pix QR codes through the same payment orchestration platform, and parts of the hosting infrastructure overlap across kits. The evidence points to a single threat actor, or a tightly coordinated cluster, running the whole architecture.
That matters for defenders. Domains are disposable, and the attackers spin up new ones on cheap TLDs and free hosting platforms faster than blocklists can keep up. The shared monetization layer is far harder to replace, which makes it the best place to cut the operation off.
Closing the Visibility Gap
By exploiting the CPF as a digital identity key alongside the irreversible immediacy of Pix, this micro-fraud ecosystem has become one of the most scalable social engineering operations in the region. Relying on traditional web intelligence engines to map this threat leaves organizations with a massive visibility gap.
Lumu’s CTI team tracked nearly 900 domains linked to this campaign over the past year. By utilizing continuous network metadata analysis and proactive threat hunting, Lumu tripled the visibility of attacker infrastructure compared to traditional engines.
New domains per week in 2026: traditional web intelligence engines (blue) vs. Lumu hunting (red), with a lane for each scam type.
Lumu takes a different approach. By continuously analyzing network metadata and correlating shared monetization infrastructure in real time, Lumu delivers early-stage intelligence through exclusive telemetry feeds, so security teams can block these campaigns before public disclosure and before they reach scale.
For organizations operating in Brazil, a few immediate steps help:
- Block the known infrastructure. Load the full IoC list from the report below into your controls.
- Hunt for lookalikes. Watch DNS traffic for domains imitating gov.br, the Central Bank, Valores a Receber, or your own brand, especially on free hosting platforms.
- Educate customers and employees. Legitimate government programs and banks don’t ask for a Pix fee to release money you’re owed. A fee to unlock a payout is the red flag.
Dive Deeper into the research: For a complete technical breakdown, including the full list of tracked domains, Indicators of Compromise (IoCs), and MITRE ATT&CK mapping, download the full research report here in English or Portuguese.
Share this post