Fake IT Calls Push AnyDesk in Brazil Heists

How the attack worked

BREEZE COMET, a financially motivated group tracked by Mandiant and Google, combined two social engineering paths to gain footholds inside Brazilian organizations. In one path, attackers placed voice calls impersonating IT support teams, pressuring employees to install remote monitoring and management tools such as AnyDesk under the guise of fixing a problem. In the other, the group staged malware and remote access tools on compromised small government websites, disguising infostealers as legitimate tax or receipt documents, including a file named ComprovantePDF.exe.

Once inside, the actor moved toward organizations with access to payment rails, specifically those able to initiate transactions through Pix, STR, and Boleto systems, then executed waves of fraudulent transfers. The group also attempted to cover its tracks by clearing event logs and deleting attacker-created directories.

Why it succeeded

Several factors made this approach effective:

• The IT support pretext exploited the routine trust employees place in internal help desk contacts, especially when the caller sounds knowledgeable and the request feels urgent.
• Hosting payloads on compromised government websites gave the malicious files an appearance of legitimacy and let attackers avoid detection by network domain reputation filters that might flag unfamiliar or newly registered domains.
• Disguising executables as everyday business documents, like tax receipts, reduced suspicion since employees expected a PDF, not a program to run.
• The attackers specifically sought out roles and systems tied to payment processing, concentrating effort where the payoff was largest.

What to watch for

• Unexpected inbound calls claiming to be internal IT support, especially ones pushing installation of remote access software.
• Requests to install a generic remote tool like AnyDesk rather than following the organization's standard support process.
• Downloadable

How did BREEZE COMET trick employees into installing remote access tools?

The group made voice calls impersonating IT support teams and convinced users to install Remote Monitoring and Management tools such as AnyDesk to resolve a fake issue.

What made the fake tax document lure effective?

The attackers disguised infostealers as legitimate tax or receipt documents, such as a file named ComprovantePDF.exe, and hosted them on compromised Brazilian small government websites so the source looked trustworthy.

Why were payment operations staff a particular target?

BREEZE COMET targeted organizations with permission to conduct transactions through banking software, APIs, and payment systems such as Pix, STR, and Boleto, since those roles could enable fraudulent transfers.

What should employees do if they get an unexpected IT support call?

Treat unsolicited IT support calls as untrusted, hang up, and call IT back using a known company number before installing any software.