- The Mess: A newly tracked criminal group is breaking into Brazilian financial institutions and going straight after cloud credentials, DevOps pipelines and crypto custody secrets.
- The Damage: Stealing one temporary cloud credential can become a path to cryptocurrency wallets and payment infrastructure.
- The Fix: Lock down cloud metadata access, audit CI/CD pipelines and treat custody secrets as hostile targets.
Brazilian banks have a new problem, and it is not another commodity banking trojan.
CrowdStrike is tracking a financially motivated actor called Slim Spider, active against Brazilian financial institutions since at least March 2026. The group shows detailed knowledge of Brazil’s financial infrastructure, including the Pix instant-payment system, digital-asset platforms and cloud environments.
The interesting part is where Slim Spider starts looking for money.
Not at the customer’s laptop.
Inside the cloud.
The Cloud Credentials Come First
In one observed intrusion, Slim Spider used custom Bash scripts to query cloud instance metadata and steal temporary credentials.
That gives an attacker something much more useful than a random password: legitimate cloud identity material already trusted by the environment.
The group then enumerated secrets stored in the cloud credential manager and modified scripts to extract credentials associated with digital financial assets.
This is classic cloud abuse with a financial target.
The attacker does not need to smash through every service exposed to the Internet if the credentials already inside the environment can open the next door.
Then Azure DevOps Gets Compromised
Slim Spider also moved into the development and deployment layer.
CrowdStrike observed the actor abusing Azure DevOps pipelines and managed Kubernetes infrastructure to deploy malicious components. Some implants were disguised as infrastructure-related binaries to blend into legitimate workloads.
The group also deployed a custom Go backdoor known as MikeDor.
That matters because CI/CD infrastructure is often trusted by design. A compromised pipeline can become the delivery mechanism for malware across an entire cluster.
The attacker does not need to compromise every Kubernetes node individually.
Compromise the pipeline that controls them.
The Real Prize: Financial Secrets
Slim Spider’s objective goes beyond ordinary credential theft.
CrowdStrike observed the actor targeting cryptocurrency custody information and payment infrastructure. The group used cast, part of the Foundry Ethereum development toolkit, to derive wallet addresses from stolen private keys.
It also used OpenSSL directly from Bash scripts for cryptographic operations.
That tells you what the attackers actually want.
Not data for resale.
Not ransomware leverage.
Keys that can move money.
The campaign also shows knowledge of Pix and the infrastructure surrounding Brazilian financial transactions. CrowdStrike describes the actor as having deep operational knowledge of the country’s financial ecosystem.
This Is Why Metadata Services Matter
Cloud instance metadata is convenient because applications can retrieve temporary credentials without storing long-lived secrets locally.
It is also extremely attractive to attackers.
If a compromised workload can query the metadata endpoint, an attacker may be able to obtain credentials belonging to the workload’s cloud identity.
That turns an application compromise into a cloud compromise.
And once DevOps, Kubernetes and secret-management systems are connected, the blast radius grows very quickly.
Bugstoday Opinion
Slim Spider is a good example of where serious financial attacks are heading.
The attacker does not necessarily need to attack the bank’s payment application directly.
Steal the cloud identity.
Enumerate the secrets.
Hijack the pipeline.
Enter Kubernetes.
Find the custody infrastructure.
Take the keys.
That is a much cleaner attack chain than throwing malware at thousands of banking customers and hoping somebody clicks.
Brazil’s Pix ecosystem makes the story particularly interesting, but the underlying technique is global.
If your CI/CD pipeline can deploy to production and your production environment can reach your financial secrets, that pipeline is part of your financial attack surface.
Treat it accordingly.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- CrowdStrike — Slim Spider Adversary Profile
- The Hacker News — Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
- CrowdStrike — 2026 Threat Intelligence Reporting
