GoPix Banking Trojan: Memory-Only Implants with PAC-Based MITM and Malvertising Delivery — Threadlinqs Intelligence
As of 2026-05-30, GoPix Banking Trojan: Memory-Only Implants with PAC-Based MITM and Malvertising Delivery is a high-severity malware threat attributed to a Brazil-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0235 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Brazil · FINANCIAL
GoPix is a sophisticated Brazilian banking trojan actively targeting financial institution customers and cryptocurrency users via malvertising campaigns. It employs memory-only execution, PAC file
GoPix is an advanced banking trojan originating from Brazilian cybercriminal groups, active since December 2022 and continuing through March 2026. The malware represents a significant evolution in Latin American financial crime tooling, adopting techniques historically associated with nation-state APT groups.
## Delivery and Initial Access
GoPix spreads through malvertising campaigns leveraging Google Ads that impersonate popular services including WhatsApp, Google Chrome, and Correios (the Brazilian postal service). Victims clicking these ads are directed to malicious landing pages that employ legitimate anti-fraud IP scoring services to screen targets and filter out security researchers and sandboxes. The landing page checks for the presence of Avast Safe Banking by probing localhost port 27275, then returns a JSON response with two URLs depending on detection results.
If Avast is not detected, the victim receives an NSIS installer executable digitally signed with a stolen code-signing certificate issued to PLK Management Limited (the same certificate legitimately signs Driver Easy Pro software). The installer creates and runs an obfuscated batch file that launches PowerShell for next-stage download. If Avast is detected, the victim instead receives a ZIP archive containing a LNK shortcut with an obfuscated PowerShell command that bypasses browser download restrictions.
## Multi-Stage Memory-Only Infection Chain
The infection proceeds through multiple memory-only stages designed to leave minimal disk artifacts:
1. An initial PowerShell script collects system information and contacts C2 for a JSON configuration containing folder/file names for %APPDATA%, an obfuscated PowerShell script, an encrypted PowerShell script (ps), encrypted malicious code (sc), and a GoPix configuration file (pf).
2. The obfuscated PowerShell script decrypts the encrypted PowerShell payload and launches a new PowerShell instance via stdin, keeping decrypted content memory-only.
3. The decrypted PowerShell performs in-memory decryption of GoPix dropper shellcode, main payload shellcode, and the main implant. It creates a small shellcode piece within the PowerShell process and jumps to the GoPix dropper shellcode.
4. The shellcode (architecture-specific x86/x64) uses API hashing via CRC32 in newer versions (stack strings in older versions) and erases MZ signatures from loaded modules to evade memory scanning tools.
5. The GoPix dropper verifies execution within Explorer.exe, detects installed browsers (Chrome, Firefox, Edge, Opera), uses direct syscalls to launch the chosen browser in a suspended state, and injects the main shellcode and parameters into the browser process.
## Main Implant Capabilities
The GoPix main implant operates entirely in memory within the injected browser process and provides three core capabilities:
**Clipboard Hijacking:** Monitors clipboard content for Pix instant payment transaction keys, Boleto bancario typeable lines (e.g., 23790.12345 60000.123456...), and Bitcoin/Ethereum wallet addresses. Pix and Boleto data is exfiltrated to C2, while cryptocurrency wallet addresses are silently replaced with attacker-controlled addresses.
**PAC-Based Man-in-the-Middle:** GoPix deploys a malicious Proxy AutoConfig (PAC) file and local HTTP server to intercept and manipulate banking traffic in real-time. Unlike traditional PAC-based phishing redirects, GoPix manipulates traffic while the user navigates the legitimate financial website. The PAC file uses CRC32 hashing of domain names to hide targeted banking sites. The local proxy enumerates network connections, identifies the originating process, and compares the process executable CRC32C checksum against a hardcoded browser list, terminating non-browser connections. Multiple Brazilian financial institutions are targeted including state government banking portals and major commercial banks.
**Root Certificate Injection:** GoPix injects a trusted root certificate directly
Target sectors: financial-services, banking, government, cryptocurrency, retail
Target regions: Brazil, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1059, T1204, T1204, T1547, T1547, T1140, T1036, T1553, T1480