‘PixRevolution’ Android Trojan Hijacks Brazil’s PIX in Real-Time

Zimperium zLabs uncovered "PixRevolution," an Android banking trojan targeting Brazil's PIX payment system that uses social engineering and Android Accessibility Services to stream victims' screens to a human/AI operator via a persistent TCP connection; the operator performs live recipient-key swaps during transfers while displaying a brief overlay so victims see a completed transfer, making rapid recovery unlikely. The malware shows operational polish (hardcoded Brazilian bank logos, monitoring of Portuguese financial phrases) and is distributed via fake Google Play Store listings.