Real-Time Banking Trojan Strikes Brazil's Pix Users

## Executive summary PixRevolution is an Android banking Trojan targeting Brazil's widely used Pix payment system; it infects users via fake Play Store pages, requests a malicious accessibility option, then enables real-time screen capture and operator/AI-driven hijacking of transactions (C2 on port 9000, HTML overlays and transaction-related keyword monitoring). The report highlights the malware's precision timing, social-engineering distribution, and the recommendation that financial institutions integrate mobile threat visibility into fraud detection and authentication workflows.