Magecart on Pix: the attack that swaps the QR code, not the card

Magecart on Pix is the Brazilian version of an old attack: the malicious code that used to copy card numbers on the payment page now swaps the Pix QR code (Pix is the instant payment system run by Banco Central do Brasil, Brazil's central bank) and the Pix Copia e Cola code (the text version of the payment code that the customer copies and pastes into their banking app). The customer pays the right amount, at the right store, and the money goes to another account. In September 2026, this pattern was found on 90 Brazilian online stores.

The September 2026 case

On September 1, the independent researcher known as eremit4 published the finding and called the attack "the new Brazilian magecart". Kaspersky confirmed it and released the numbers on September 9. The public facts, gathered by the company and the press:

• 90 small and mid-sized stores infected, all using the same open-source e-commerce platform, without up-to-date patches.
• An attack on the site, not on the customer's computer. Every shopper who chose Pix at these stores received the swapped code.
• QR code and Copia e Cola swapped together. People paying on their phone by copying the code were hit the same way as those who scanned.
• No sign on screen. According to Fabio Assolini, of Kaspersky, the swap leaves no visual trace for the customer.
• Cards too. When the customer chose credit card, the same code copied the details for later use.
• The signal for merchants was a rise in drop-offs: orders with Pix stayed pending and never got paid.

Three days later, Procon-SP (the consumer protection agency of São Paulo) published guidance for consumers about the scam that alters the Pix QR code in online purchases.

What changes compared with Magecart on cards

The mechanism is the same: code hidden on the payment page, triggered only at checkout. The consequence is different.

• Timing. With cards, the data is sold or used days later. With Pix, the money leaves on the spot.
• Who takes the hit first. With cards, the store gets paid and the problem shows up later as fraud against the customer. With Pix, the store gets nothing, and the customer believes they paid.
• Recovery. With cards there is the chargeback route through the issuer. With Pix, the customer requests MED (Mecanismo Especial de Devolução, the Pix refund mechanism for fraud cases), which only returns money if there is still a balance in the receiving account. According to press reports, scammers spread the money across dozens of accounts within a few hours.
• What the attacker needs to steal. With cards, they need to read the fields and send the data out. With Pix, it is enough to swap a piece of text and an image on screen. Nothing has to leave the page, which makes detection harder for anyone watching the traffic.

Why common defenses miss it

An anti-fraud tool analyzes the transaction, and the transaction is valid: right amount, real account, legitimate customer. The gateway generated the correct QR code and delivered it to the store. The infected file may be on the store's server, but the code may also come from an external address, loaded only in the browser.

A tool that lists scripts and alerts when a new one appears can also stay silent if the code is inside a file that was already approved. We explain this in why a script inventory does not detect a swapped QR code.

The question that settles it is a different one: is the QR code the customer is seeing the same one the store issued?

What some stores did

According to press reports, affected merchants took three routes: showing the CNPJ (Brazil's company registration number) and the company name next to the QR code, removing the QR code from the page and asking for the receipt manually, or switching to a payment intermediary's payment page. All three reduce the damage. None of them removes the code from the store.

Showing the CNPJ helps the attentive customer, but the same code that swaps the QR code can swap that text. Removing the QR code kills Pix conversion, and Pix exists precisely to be fast. Using an intermediary's page takes the charge out of reach of the code installed on the store, at the cost of changing the checkout journey, and the code stays there, waiting for the next form.

How a store protects itself from Magecart on Pix

1. Update the platform, theme and plugins. What the 90 stores had in common was overdue maintenance.
2. Turn on two-factor authentication for the admin panel and review who has access.
3. Track the pending Pix rate by day. A jump with no business reason is the first sign.
4. Compare the QR code displayed with the QR code issued. The check has to happen in the customer's browser, after the page loads, because that is where the swap happens.
5. Block before payment. An alert afterwards helps the investigation, but the sale and the customer's money are already gone.
6. Prepare customer support. See the step-by-step for when the customer paid by Pix and the order was not confirmed.

For the full picture, from cards to boleto (the Brazilian bank payment slip), read Magecart: what it is and how to protect your online store.

Where Proteside fits in

Proteside performs the check in step 4 and the block in step 5. When the store or the provider generates the charge, the issued QR code and Copia e Cola code are recorded. On the customer's screen, it compares what is being displayed and copied with that record and, if there is a difference, shows a warning in place of the QR code and does not deliver the swapped code. Each attempt becomes an alert for the store, with the order, the amount and the destination found. See Pix protection at checkout.