grep -rl "brazil" ./articles
Google's threat group documented a Brazilian crew that needs RSFN network access and mTLS credentials to operate — the requirements of a payments engineer, not a fraudster. The way in was a WhatsApp message impersonating IT support and a remote-access tool.
Group-IB documented BraZetsu, a Python framework that reads ERP directories, banking keywords in window titles and digital certificates — not to steal them, but to write a listing. The AI in this story is not in the payload. It is doing triage and pricing in the back office of a marketplace.
Operation Klonen ended with four arrests in Brazil and three prosecutions in Europe over a 2023 fraud against Commerzbank. The opening was a faulty software update at a payment processor, and R$106 million in assets has been seized.