Breeze Comet targets Brazilian payment infrastructure with custom malware

Google Threat Intelligence Group and Mandiant say the financially motivated Breeze Comet group has targeted Brazilian financial services, retail, and e-commerce organizations since 2024, manipulating payment systems and banking software to make fraudulent transfers. The group has completed at least one heist worth tens of thousands of dollars, according to the report. It gains access through password spraying, impersonated IT-support calls, vulnerable JBoss servers, and compromised websites, then uses custom malware and privileged accounts to access payment applications. The activity has culminated in hundreds of fraudulent transactions, the report says.