GoPix: the malware that turns Pix into untraceable crypto
A Brazilian trojan intercepts the transfer at the exact moment and reroutes the money to a fragmented crypto wallet before confirmation.
Audience: Companies and Operations · Risk level: CRITICAL
Blindfy Intelligence Unit · Technical review by Blindfy
Scenario
The finance team sends a R$ 50,000 Pix to the usual supplier. The bank app shows the correct key. The confirmation arrives. Days later the supplier calls to collect — nothing was received. A technical investigation finds the GoPix malware on the endpoint: it altered the destination data at signing time, rerouted the money to Hyper Wallet IP and converted it into fragmented crypto within seconds.
How the scam works
Distributed via WhatsApp and corporate email as a fiscal PDF or receipt. Once active, it monitors banking apps and hooks the payment function. The instant the user confirms the Pix, it swaps the destination key without changing what appears on screen. Then platforms like Hyper Wallet IP convert the received amount into fractional crypto — fragmentation that makes tracing unviable.
Common mistake
Trusting the bank app's visual confirmation. The malware alters the transfer payload without altering what is rendered on screen — the victim sees the correct number even after confirmation.
Impact
Total, irreversible loss per transfer. Pix-to-fragmented-crypto conversion blocks blockchain tracing; chargeback is technically impossible. Financial operations with daily volume above R$ 100k are priority targets.
What works
Out-of-band validation for any Pix above a threshold (suggestion: R$ 10k): phone confirmation using the supplier's known number before the transfer. Endpoint security on every device with bank access. A two-approver payment policy.
Protection checklist
- Set a Pix threshold that requires phone validation
- Confirm supplier Pix keys via an alternative channel for every large payment
- Audit finance team devices monthly (active EDR)
- Block PDFs/attachments from unvalidated external sources
- Keep a supplier registry with official Pix keys in a controlled system
- Adopt two-approver payments above the threshold
- Train the finance team against urgency fabricated by message
Editorial sources
- Banco Central do Brasil — Orientações oficiais sobre golpes e Pix
- CERT.br / NIC.br — Cartilha de Segurança para Internet
- ENCCLA / Ministério da Justiça — Enfrentamento a golpes digitais
GoPix marks the era in which a Pix attack becomes instant laundering. Without out-of-band validation, fraud recovery goes to zero.
