• Cyber Sentinel
  • Posts
  • [Sentinel] #6 - Insider-Led $100M Heist Hits Brazil’s Central Bank

[Sentinel] #6 - Insider-Led $100M Heist Hits Brazil’s Central Bank

IT Insider Enables Millions Stolen from Brazil’s PIX—What It Means for Fintech Security

July 10, 2025

What's up, Malware Busters! 🦠

Welcome to Cyber Sentinel! Your no-nonsense guide to cybersecurity and AI. Worried about threats? You're in the right place!

🛡️ IN TODAY’S EDITION

🧨 1. Breach of the Week

Target: Brazil’s Central Bank (PIX Payment System)

Vector: Insider-aided credential compromise at fintech vendor

Impact: Over 540 million Brazilian reais (approx. $100 million) siphoned from Brazil’s instant payment system, PIX, in a single night. The breach targeted C&M, a software integrator connecting financial institutions to the Central Bank. João Roque, a C&M IT employee, sold credentials to hackers, enabling massive fraudulent PIX transactions. A major bank faced losses, with 270M reais frozen.

Lessons:

  • Insider threats remain one of the most potent risks to financial infrastructure. Continuous monitoring and credential controls are critical.

  • Vendor and third-party integrations can become high-value targets; audit and restrict access aggressively.

  • Rapid asset freezing and cross-institutional coordination are essential for damage control in real-time payment ecosystems.

🧠2. AI Threats: Telegram Malware Surge

A new malware campaign is leveraging Telegram as a command-and-control channel for the tRat remote access trojan, specifically targeting Linux systems. This approach allows attackers to execute arbitrary commands and exfiltrate sensitive data while blending malicious activity with legitimate encrypted messaging traffic.

  • Why it matters: Using popular messaging apps for malware control makes detection harder and increases the risk of widespread compromise.

  • Defensive tip: Monitor for unusual outbound connections to messaging platforms from servers and endpoints.

📍Takeaway: As attackers exploit mainstream platforms for command and control, defenders must expand monitoring beyond traditional threat indicators.

🔒 3.Microsoft Patch Tuesday: Critical Zero-Day Fixes

Microsoft’s July 2025 Patch Tuesday delivered fixes for 130 vulnerabilities, including a publicly disclosed zero-day (CVE-2025-49719) in SQL Server. This month’s update also includes a dozen critical patches for remote code execution flaws in SPNEGO, SharePoint, and Kerberos services.

🔹 Why it matters:

  • Critical infrastructure and enterprise applications remain prime targets for exploitation.

  • Prompt patching and driver updates are essential to mitigate risk from newly disclosed vulnerabilities.

  • Organizations should review their patch management processes to ensure rapid deployment. Especially for internet-facing systems.

🛠 Pro tip: Update SQL Server and dependent drivers immediately to close off this attack vector.

📡 4. Attack Surface: Chrome Extensions on the Scope

Recent investigations uncovered that dozens of Google Chrome extensions were secretly siphoning sensitive data from 2.6 million devices over several months. The malicious extensions, distributed via spear-phishing and rogue OAuth applications, stole credentials for services like Facebook and OpenAI ChatGPT (they are so cooked).

  • Key risks: Browser extensions are often overlooked in security reviews, yet they can access vast amounts of user data.

  • Mitigation: Regularly audit installed extensions, enforce least-privilege policies, and educate users about phishing tactics.

🔐 Browser extensions are part of your attack surface. Treat them with the same scrutiny as any other endpoint application.

🔓 5. Free Resources for You

Here’s what I’ve found most helpful this week:

👉 For Now, One Quick Question

Since this project is just getting started, I’d love to hear from you early!

Shape our next Cyber & AI publication — take our quick survey now! 🤖🔒

💬 Hit reply and let me know—I'll build this newsletter to serve the challenges you're facing, not just the ones trending on Twitter!

🔐 Stay sharp. Stay secure.


This newsletter is crafted with focus, scepticism, and zero hype. Just field-relevant insights at the intersection of cybersecurity and AI.

💬 Got a tip, tool, or topic suggestion? Hit reply! I read every message!
🌍 Published by Sentinel