Extensions and malware that swap Pix on the customer's computer

Not every diverted Pix payment starts with a hacked store. Malware and browser extensions installed on the buyer's computer can swap the Pix key or payment code (Pix is Brazil's instant payment system) at the moment the buyer copies, pastes or views the charge. The store was not attacked, yet it is the one that doesn't get paid, handles the complaint and takes the blame. Understanding how these scams work helps separate what the store controls from what it doesn't, and reduce the damage in both cases.

Cases documented by researchers

Malware that watches the clipboard. In October 2023, Kaspersky's research team described GoPIX, a program that monitored the clipboard on Windows computers. When the victim copied a Pix payment code during a purchase, the program replaced it with another one fetched from a criminal server. The same program swapped Bitcoin and Ethereum wallet addresses. According to the company, the campaign had been active since December 2022, most infections were in Brazil and it spread through sponsored ads shown to people searching for “WhatsApp web”.

The detail that matters to merchants: the victim copies the correct code from the store's page and, without noticing, pastes a different one into the banking app.

The same family, more sophisticated. In March 2026, Kaspersky published a new analysis of the same family. The program now runs almost entirely in memory, leaving no obvious files, and intercepts browser sessions with banking sites using proxy settings and fake certificates installed covertly. In the version analyzed, it monitors Pix transactions and boleto payment slips and still swaps copied cryptocurrency wallet addresses.

Browser extensions that tamper with Pix. In November 2023, Trend Micro described a malicious Chrome extension aimed at Brazilian users, loaded into the browser through a modified shortcut. It collected data on Banco do Brasil and Caixa pages, read Pix-related fields such as keys and taxpayer IDs and, according to the researchers, could initiate and manipulate Pix transactions. An extension runs inside the browser and sees the pages the user opens, including a store's payment page.

Why the store is still affected

From the customer's point of view, they paid the store. The order wasn't approved and the money is gone. The natural reaction is to complain to the seller, often in public.

• The store doesn't get paid. Pix has no merchant- or customer-initiated chargeback. Recovery goes through the Special Return Mechanism (MED), which the customer triggers with their own bank, and any refund goes back to the customer, not to the store.
• The store has to investigate. From the outside, an infected computer and a tampered payment page produce exactly the same symptom: a receipt showing another recipient. Until it finds out which one it is, the store doesn't know whether other customers are being hit.
• The store loses the sale and the customer. Even if the case is resolved, the experience is now tied to the brand.

What the store controls and what it doesn't

It is worth being honest about the reach of each measure.

• Extensions that alter the store's page act in the same place a malicious checkout script would: what the buyer sees. This kind of swap can be detected and blocked by a check that compares, on the buyer's screen, the QR code, key and code displayed with the ones the store issued.
• Malware that swaps the clipboard at the operating-system level acts after the content leaves the page, on the customer's computer. No store code can see that step. Here the defense is giving customers what they need to notice the swap before confirming.

Checklist to reduce the risk

1. Show your company's legal name and tax ID next to the QR code exactly as they appear in the banking app, with a prompt to check the recipient before confirming.
2. Suggest scanning the QR code with a phone when the customer is on a computer, so the code never passes through the clipboard.
3. Confirm payments quickly and notify the customer in real time; the sooner they notice the order didn't go through, the better their chances with the MED.
4. Keep scripts on the payment page to a minimum and monitor what the live page displays.
5. Have a support script for “I paid but it didn't go through” that compares the recipient on the receipt and guides the customer to dispute in their banking app.
6. Add a calm note to your help page about extensions and software downloaded from ads.

See also how the swap happens on the page and how it is blocked in Pix protection at checkout.

Proteside protects the part that lives on your store's page: it checks, in the buyer's browser, that the QR code, key and code copied by the button are the ones you issued, and blocks any change, including one made by an extension, before payment, with an alert and evidence. Try it free for 14 days and see how it works.