Researchers at Group-IB have pulled apart a Brazilian malware kit that does not just steal data, it turns the computers it infects into a product. The framework, which the team named BraZetsu, scans a hacked machine for anything of value, from corporate banking software to police and industrial systems, then feeds that intelligence into an underground marketplace where its operators sell hands-on access to the highest bidder.
Group-IB attributes the tool with high confidence to a Brazilian actor it tracks as Exilware, and says it has watched BraZetsu evolve since February 2026 from a basic remote-access tool into the intelligence engine behind a criminal storefront known as the "Infected Marketplace" (or "Banco de Infects"). Buyers who purchase access can then run their own follow-on payloads on the victim, which spreads the damage well beyond the original break-in.
An AI that sorts the stolen goods
What sets BraZetsu apart is how much of it appears to have been built and run with generative AI. Its code is littered with chatty, emoji-tagged log messages, a well-known fingerprint of AI-written code, and Group-IB assesses with moderate confidence that the developers are native Portuguese speakers. More striking, some of those log strings openly reference an AI engine running on the attackers' own command-and-control server, whose job is to triage stolen files and decide which victims are worth pursuing first. In plain terms, the crooks are using a machine to read the loot so they do not have to.
Built to find the crown jewels
BraZetsu is written in Python and compiled with Nuitka, a trick that helped some samples stay completely undetected by antivirus engines on VirusTotal months after discovery. Rather than grabbing passwords and cookies like a typical infostealer, it pulls the victim's browser history and cross-references it against a list of nearly 230 sensitive domains to map what the person actually does. It then runs about twenty checks to tag high-value machines: it looks for endpoint security tools such as CrowdStrike and SentinelOne, ERP and banking software like SAP, TOTVS and Topaz, industrial control systems, cloud and DevOps keys, hospital record systems, and even police workstations, which it spots from hostname prefixes such as PC- and PM-.
The malware is tuned for the region's money plumbing. It hunts for CNAB files, the standardized remittance files Brazilian firms use to send batches of payment instructions to their banks, and digs recursively through the file system and OneDrive for PFX and P12 digital certificates, bundling them with a machine profile before shipping everything to its server. It can also take screenshots and open a remote shell for interactive control.
Fake court notices as the way in
Group-IB has not nailed down the exact infection route, but it found a distribution domain, caixaentradas1inboxshop[.]site, serving loaders with names like wifi_driver.exe and VBS scripts posing as a Portuguese legal notification ("processo de intimacao"), which points to old-fashioned social engineering. Those files overlap with samples of the Ousaban banking trojan, and BraZetsu shares its CNAB-hunting directory list with a separate fraud tool called CNABHunter that a researcher first flagged on X on 7 May 2026, though Group-IB says any direct link between the two is still unknown. The malware pulls its live server address from a Pastebin page, decoding it to c2[.]installscenter[.]com.
BraZetsu is aimed squarely at Iberia and Latin America, a region that has long been a proving ground for homegrown financial malware. IntelFusions has recently covered the return of the Grandoreiro banking trojan and the Astaroth banker that hijacks WhatsApp Web, and BraZetsu extends that lineage with an access-for-sale model and an AI back office. Defenders in the region should watch for the domains above, restrict outbound connections from finance and ERP hosts, and treat any BraZetsu infection as a beachhead that has likely already been sold on. You can read the original Group-IB report for the full technical breakdown.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.