Slim Spider Threat Actor Targets Brazilian Financial Institutions to Steal Crypto Custody Secrets

A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment systems, to conduct financially motivated attacks aimed at stealing crypto custody secrets and sensitive financial data. The group's activities highlight the growing risk to financial institutions in regions with rapidly evolving digital payment ecosystems. CrowdStrike's analysis indicates the actor possesses specialized knowledge of local financial frameworks, enabling targeted intrusions and data exfiltration. The reporting emphasizes the need for enhanced monitoring and threat intelligence sharing within the financial sector to counter such regionally sophisticated threats.