Slim Spider: The Brazilian Crew Quietly Robbing Banks Through Pix
A newly named criminal group is targeting Brazil's financial system with deep knowledge of instant payments and crypto custody.
Key points
- CrowdStrike named a new financially motivated group Slim Spider, tracked since at least March 2026.
- The group is based in Brazil and targets Brazilian banks and payment firms.
- Attackers show detailed knowledge of Pix, Brazil's instant payment system used by hundreds of millions of people.
- Recent activity includes stealing crypto custody secrets from a Brazilian financial institution.
- No public list of victims or dollar figures has been released.
A new criminal crew is quietly picking apart Brazil's banking plumbing, and CrowdStrike has finally given it a name: Slim Spider. This is the second Brazil-focused financial threat we've reported in as many weeks, after our 1 September story on Breeze Comet, which caught Mandiant tracking a separate crew that had been hijacking payment software since 2024.
Slim Spider isn't a nation-state operation. It's in this for the money. CrowdStrike says the crew has been active since at least March 2026, is based in Brazil, and knows the country's payment systems the way a locksmith knows a lock.
That matters because Brazil runs on Pix, the central bank's instant payment system that settles transfers in seconds, around the clock. Almost every adult in the country uses it. Criminals who understand how banks plug into Pix know where the soft spots are.
Who is Slim Spider?
Slim Spider is a financially motivated group that CrowdStrike says operates out of Brazil and hits Brazilian financial firms: local criminals robbing local banks, using code instead of masks.
CrowdStrike, first reported by The Hacker News, describes the crew as having "deep operational knowledge" of how Brazilian banks connect to Pix and the broader payments network. That's not the profile of a random ransomware gang scanning for open doors. It reads more like insiders, or people who used to work in the industry.
One recent intrusion involved stealing crypto custody secrets from a Brazilian financial institution. Custody secrets are the digital keys a firm holds to control cryptocurrency on behalf of clients. Whoever holds those keys can move the coins.
How are they getting in?
CrowdStrike hasn't published a full technical breakdown, so the exact intrusion method isn't public. What the firm has said is that the group tailors its work to Brazilian banking software and internal payment tools rather than generic malware.
In practice that usually means phishing emails aimed at staff combined with abuse of the trusted software banks use to talk to Pix and card networks. The failure mode is familiar: a payments engineer clicks the wrong link, and their session token becomes the attacker's. One thing the post-mortem will almost certainly confirm is that the attackers moved through systems never designed to be reachable from a laptop.
Should you worry?
Right now there's no public evidence that customer accounts were drained or that Pix itself is broken. The reporting points at the banks and payment firms, not at individual users.
If you bank in Brazil, the sensible moves are the same ones that always help. Turn on every alert your bank offers for Pix transfers and card use so a strange payment hits your phone within seconds. Treat any message asking you to confirm a Pix key or hand over a code as hostile until proven otherwise.
Crypto customers of the affected institution are in a trickier spot. If custody keys were stolen, the firm holding your coins has to rotate those keys and prove the funds are intact. Ask them, in writing.
Why this story matters beyond Brazil
Slim Spider is a preview of a wider pattern. Instant payment rails are spreading fast: Pix in Brazil, UPI in India, FedNow in the United States, SEPA Instant in Europe. Each one gives criminals a fast channel to move stolen money before anyone notices.
If your bank plugs into an instant payment network, assume someone is already mapping how you plug in. That's the one sentence the next post-mortem should have opened with.
