GoPIX Malware

GoPIX is a malicious software that specifically targets the Pix instant payment platform. Essentially, this malware functions as a clipper, with the primary purpose of redirecting transactions made through the Pix platform. Additionally, it functions as a more typical clipper, where it also targets cryptocurrency transactions.

This malicious program, known as GoPIX, has been in circulation since at least December 2022. Given that Pix is a payment system managed by the Central Bank of Brazil (BCB), its user base predominantly consists of Brazilian citizens. Consequently, GoPIX's activities are primarily concentrated within Brazil.

At the time of this writing, GoPIX infections are primarily initiated from malicious websites promoted through deceptive advertisements, a technique known as malvertising, a form of search engine poisoning. Presently, the malware is downloaded from one of two sources, depending on whether the victim's device has port 27275 open.

This particular port is utilized by a secure banking product developed by a cybersecurity company. When this software is absent from the targeted device, an NSIS installer package is downloaded, which includes PowerShell scripts. More scripts are subsequently downloaded, initiating the infection process that eventually leads to GoPIX. However, if the legitimate software is present, a ZIP archive is downloaded. Inside this archive is an LNK file that contains a PowerShell script, which then advances the infection process.

GoPIX Monitors Clipboard for More than Pix

As mentioned earlier, GoPIX functions as a clipper. Malware of this type detects the content copied to the clipboard (copy-paste buffer) and replaces it with different information. In the case of GoPIX, it specifically scans for Pix transfers. When it identifies a payment request, it alters the data, effectively redirecting the transaction to the cybercriminals. Notably, the attacker's information is not hardcoded into the malware but is retrieved from a Command and Control (C&C) server, providing flexibility.

GoPIX also serves as a clipper that replaces cryptocurrency wallet addresses, which is a more common type of clipper. However, the Bitcoin and Ethereum wallet addresses are predefined, unlike the Pix data, which allows for more flexibility in the latter.