Executive Summary
Slim Spider is a Brazil-based e-crime group that has been targeting financial institutions since at least March 2026. They demonstrate high operational maturity in cloud-native environments, specifically targeting digital asset platforms and the Pix instant payment service. The actor utilizes custom Bash scripts and cloud-native tools to bypass traditional security controls, focusing on the theft of cryptocurrency custody secrets and private keys.
The attack chain involves multi-stage intrusions using compromised cloud credentials and advanced techniques such as device code phishing and malicious Azure DevOps pipelines. Concurrently, another group named Breeze Comet (also known as Plump Spider) has been observed infiltrating Brazilian financial systems to abuse payment infrastructure like Boleto and STR, indicating a significant shift from retail fraud to direct core financial infrastructure attacks.
These campaigns represent a critical threat to the financial sector in Latin America. The transition to cloud-conscious tradecraft—leveraging containers, Kubernetes, and API-scanning automation—allows these actors to bypass perimeter defenses and target high-value financial assets directly.