> Concept · PIX QR Code Fraud_

~/packetpursuit $ cat /intel/concepts/pix-qr-code-fraud.md

typeconceptconfidencemediumcreated2026-08-07updated2026-08-07banking-trojanlatamqr-codepixfraud

pix-qr-code-fraud

Cross-family concept for banking trojans that hijack Brazil's PIX instant-payment system by generating attacker-controlled QR codes.

Pattern

PIX (Pagamentos Instantâneos do Brasil) uses QR codes for instant bank transfers. Banking trojans embed ZXing or custom QR encoders to:

  1. Intercept a victim's attempt to generate a payment QR code.
  2. Replace the victim's QR with one encoding the attacker's PIX key.
  3. Use screen capture and synthetic input to hide the substitution from the victim.

Observed Implementations

  • bromechokucom (36a4bca2) embeds full DelphiZXingQRCode with all error-correction levels and mask patterns, alongside TValorClickHelper for banking UI manipulation ^[/intel/analyses/36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.html].

Related