Reported by 2 outlets

Timeline

1. original reporting

   Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions

   gbhackers.com · 41d ago · September 2nd, 2026

   A financially motivated threat actor tracked as BREEZE COMET has breached Brazilian financial, retail, and eCommerce organizations, using privileged access to payment platforms to execute hundreds of fraudulent transactions in tightly timed waves. The activity overlaps with clusters publicly identified as Plump Spider and SHADOW-AETHER-064, although GTIG’s reporting frames this as operational overlap rather than […] The post Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Hackers Use AI Malware to Break Into Brazilian Banks and Make Fraudulent Transfers

   cyberpress.org · 41d ago · September 2nd, 2026

   Brazilian financial organizations are facing a growing threat from a cybercrime group tracked as BREEZE COMET. Since 2024, Mandiant has investigated attacks against financial services, retail, and eCommerce companies in Brazil. The group is financially motivated and focuses on breaking into systems that can process payments. BREEZE COMET, previously known as UNC5669, is linked to activity reported as Plump Spider and SHADOW-AETHER-064. Its goal is not ordinary banking fraud against individual customers. Instead, it attempts to compromise organizations that have direct access to banking software, payment APIs, and Brazil’s payment infrastructure. The attackers target banks, payment processors, fintech firms, exchanges, retailers, and banking-software providers. They seek access to systems connected to Pix, STR, Boleto, and other transaction platforms. If successful, they can use stolen credentials and privileged accounts to submit fraudulent transfers in the name of a legitimate organization. The group needs several things to complete its fraud operations: access to Brazil’s National Financial System Network, valid mTLS certificates, persistent access to Active Directory or cloud accounts, and knowledge of the victim’s payment processes. This makes the attacks more complex than common phishing campaigns, but potentially far more damaging. AI Malware Targets Brazil BREEZE COMET has used password spraying, voice phishing, malicious remote-management tools, and rogue hardware dev