Skip to content

Malware that swaps the Pix QR code: your device or the store?

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

There are two types: malware on the shopper's device, which swaps the copied or displayed code, and malicious code on the store's website, which swaps the QR code for every customer. If only you were hit across several stores, suspect your device; if several customers of the same store paid another name, the problem is on the site.

Malware that swaps the Pix QR code (Pix is the instant payment system run by Banco Central do Brasil, Brazil's central bank) can be in two places: on the shopper's device or on the store's website. On the device, it swaps the copied code or the image on screen, at any store you visit. On the website, it swaps the QR code for every customer of that store, even when each customer's computer is clean. Knowing which one is your case changes what you should do.

Type 1: malware on your computer or phone

These are programs that install themselves on the device and wait for a payment. The cases documented by researchers work in three ways:

  • Swapping what you copy. When it recognizes a Pix code on the clipboard, the program replaces it with the scammer's. You paste it into your banking app and pay someone else. Kaspersky described this behavior in 2023 in a family called GoPix.
  • Tampering with the page you see. Newer versions insert themselves into the browser and change the content of pages. In March 2026, Kaspersky published an analysis of the current GoPix: it runs only in the computer's memory, arrives through fake ads on search engines and watches Pix and boleto (Brazilian bank payment slip) transactions.
  • Browser extensions. In 2023, Trend Micro documented malicious browser extensions aimed at Brazilian users, able to read and change open pages, including banking pages.

How to recognize it: the problem shows up at more than one store, or with codes copied from different places. It can also happen when you pay boletos or bills.

Type 2: malicious code on the store's website

Here the malware is not on your side. It was placed on the store's payment page, through an unpatched flaw, a compromised plugin or a leaked admin password. When any customer chooses Pix, the code swaps the QR code and the Pix Copia e Cola code (the text version of the payment code that the customer copies and pastes into their banking app) for the scammer's.

In September 2026, Kaspersky confirmed 90 Brazilian online stores in this situation. The company stressed that the criminal infects the site, not the victim's computer, which is why every customer of the store is hit. The attack got the nickname "the new Brazilian magecart", and we explain the term in Magecart on Pix.

How to recognize it: the problem happens only at that store, and other customers report the same thing. An antivirus on your computer will find nothing, because there is nothing on your computer.

How to find out where the problem is

Three questions help separate the cases:

  1. Did it happen at more than one store, or with boletos and bills? If so, suspect your device.
  2. Does the store confirm other customers with the same problem? If so, the problem is on the site.
  3. Did you copy the code or scan the QR code with your phone? If you scanned it with your phone from the computer screen and the payee was still someone else, the image was already swapped on screen. That points to the site or to the computer's browser, not to the phone.

What to do if the malware is on your device

  1. Dispute the Pix in your banking app with the Contestar Pix (Dispute Pix) option, reporting scam or fraud, as soon as possible.
  2. Run a scan with an up-to-date antivirus and remove browser extensions you don't recognize or don't use.
  3. Change your passwords for your bank, email and stores from another, clean device.
  4. Update your operating system and browser.
  5. If the problem continues, take the device to a technician you trust or reinstall the system.

What to do if the code is on the store's website

  1. Dispute the Pix in your banking app the same way.
  2. Tell the store and send the receipt. It may not know it has been hit. Your warning protects the next customers.
  3. Don't pay again at the same store until it confirms the problem is fixed.
  4. Keep the evidence and, if you wish, file a police report.

For the full dispute playbook, see wrong Pix payment online: mistake or scam.

The defense that works in both cases

Before confirming any Pix, read the payee's name and CNPJ (Brazil's company registration number) in your banking app. Malware can swap the code, but the banking app shows where the money is really going. If the name has no connection to the store, stop. See what to check before you pay.

For merchants

The store does not control the customer's computer, but it does control its own page. And even when the malware is on the customer's device, it is the store that doesn't get paid and that gets the complaint. Proteside checks, on the payer's screen, whether the QR code and the Copia e Cola code displayed and copied are the ones the store issued, including when the change comes from a browser extension, and blocks the swap before confirmation. See Pix protection at checkout and the post on extensions and malware that swap Pix.

Back to blog

Read next