Beware Of PixPirate Malware Attacking Users Via WhatsApp

A new and dangerous malware campaign known as PixPirate has been targeting users in recent months, primarily in Brazil and India, with infections also spreading to Italy and Mexico.

This sophisticated malware poses as a legitimate authentication application, tricking users into believing it will help secure their bank accounts. However, its true purpose is far more sinister.

PixPirate spreads through a combination of Smishing campaigns and WhatsApp spam messages from infected users.

The malware is not available on the Google Play Store, instead relying on social engineering tactics to convince victims to download and install the malicious application.

Once installed, the PixPirate downloader prompts users to install an “updated version” of the app, which is actually the full PixPirate malware.

Security Intelligence researchers noted that this deceptive technique allows the malware to gain all necessary permissions and capabilities on the victim’s device.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

Technical Analysis

PixPirate is a Remote Access Tool (RAT) with an extensive array of malicious features:-

• Financial Fraud: Primarily targets Pix payment services integrated with Brazilian banking apps.
• Data Theft: Steals user information from infected devices.
• WhatsApp Exploitation: Abuses WhatsApp to spread the malware further.
• Stealth Operations: Hides its presence by removing its icon from the home screen.
• SMS Interception: Captures and reads incoming text messages.
• Activity Recording: Monitors and logs user activities on the device.
• Anti-Detection: Employs anti-virtual machine and obfuscation techniques to evade detection.

The PixPirate malware leverages WhatsApp as a key component in its spreading strategy. If WhatsApp is not installed on the victim’s device, the malware will prompt its installation.

Once present, PixPirate can:-

• Send malicious phishing messages to contacts and groups
• Read and modify the user’s contact list
• Create new WhatsApp groups
• Block and unblock other WhatsApp accounts
• Delete messages to cover its tracks

This approach is particularly effective because WhatsApp messages often appear more trustworthy than SMS, especially when coming from known contacts.

While Brazil remains the primary target with nearly 70% of infections, India has emerged as the second most affected country, accounting for about 20% of global PixPirate infections.

Although no Indian banks are currently on the target list, security researchers suspect that the malware developers are laying groundwork for future campaigns in India, possibly targeting the widely-used United Payments Interface (UPI) system.

To avoid falling victim to PixPirate and similar malware:

• Never install apps from unknown sources or links received via messages.
• Be skeptical of unsolicited messages, even from known contacts.
• Keep your device’s operating system and apps updated.
• Use reputable mobile security solutions.
• Regularly review app permissions on your device.

As PixPirate continues to evolve and expand its reach, staying informed and vigilant is crucial in protecting your personal and financial information from this sophisticated threat.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar