Prilex
- First seen
- 2014-01-01 00:00:00
- Origin
- BR
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Actor type
- criminal
- Profile updated
- 2026-09-08 07:21:07
Targeted industries: financial-services retail-and-hospitality
Targeted regions: country_code:br country_code:de
Context
Prilex is a Brazilian eCrime group active since 2014 and named after the malware it builds. It began by attacking ATMs — during the 2016 carnival it compromised more than a thousand machines in Brazil and cloned tens of thousands of cards — and moved to point-of-sale systems later that year. Its tooling grew from a simple memory scraper into software that intercepts PIN pad traffic and produces fraudulent EMV cryptograms, letting the operators authorise transactions with cards they never physically hold. The group has reached beyond Brazil, with an attested 2019 intrusion at a German bank, and it sells its point-of-sale kit to other criminals through underground channels rather than keeping it in-house.
Detection coverage
- 1 YARA rules
Malware & tools used
- Prilex (malware)