Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government websites to get staff to install remote-access tools and malware.
BREEZE COMET, a financially motivated group tracked by Mandiant and Google, combined two social engineering paths to gain footholds inside Brazilian organizations. In one path, attackers placed voice calls impersonating IT support teams, pressuring employees to install remote monitoring and management tools such as AnyDesk under the guise of fixing a problem. In the other, the group staged malware and remote access tools on compromised small government websites, disguising infostealers as legitimate tax or receipt documents, including a file named ComprovantePDF.exe.
Once inside, the actor moved toward organizations with access to payment rails, specifically those able to initiate transactions through Pix, STR, and Boleto systems, then executed waves of fraudulent transfers. The group also attempted to cover its tracks by clearing event logs and deleting attacker-created directories.
Several factors made this approach effective:
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The group made voice calls impersonating IT support teams and convinced users to install Remote Monitoring and Management tools such as AnyDesk to resolve a fake issue.
The attackers disguised infostealers as legitimate tax or receipt documents, such as a file named ComprovantePDF.exe, and hosted them on compromised Brazilian small government websites so the source looked trustworthy.
BREEZE COMET targeted organizations with permission to conduct transactions through banking software, APIs, and payment systems such as Pix, STR, and Boleto, since those roles could enable fraudulent transfers.
Treat unsolicited IT support calls as untrusted, hang up, and call IT back using a known company number before installing any software.
You get a call: “Hi, this is IT support, we need you to install AnyDesk to fix an issue on your PC.” Sounds routine, right? Groups like BREEZE COMET use fake IT calls plus AnyDesk installs to quietly take over machines, then hit banking systems to push Pix, STR, and Boleto transfers out of your company. They even host fake “tax receipts” like ComprovantePDF.exe on real-looking Brazilian government sites, so the download and the caller both feel legit while they steal access and wipe logs. If anyone calls saying they’re IT and asks you to install AnyDesk or run a ‘receipt’ file, hang up and call our real IT number from the directory before you do anything.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
