BraZetsu Turns Infected PCs into Access for Sale to Criminals

A Marketplace Where Victims Become Inventory

A new analysis of BraZetsu, a modular Windows malware framework attributed with high confidence to Exilware, emerged on September 3, 2026. It is not a conventional infostealer: it catalogs compromised systems, estimates their economic value, and makes them available to criminal customers.

BraZetsu powers the Infected Marketplace, also known as “Banco de Infects,” and associated with the domain infect[.]online. The platform follows an access-as-a-service model: Exilware obtains and maintains initial access, while other operators pay to use machines that are already infected.

The initial deposit required to access the service is approximately $5.80. After purchasing access to a host, a customer can execute their own malware, deploy additional tools, or conduct manual activity remotely. Intrusion and monetization are therefore split between different parties.

This mechanism amplifies the consequences of a single infection. The same computer can become the starting point for data theft, financial fraud, corporate network compromise, or the installation of additional payloads.

Some of the samples analyzed were not detected by VirusTotal. This does not mean BraZetsu is always invisible, but it shows that at least some variants were able to evade the engines available on the platform at the time of analysis.

Five Generations Developed in Just a Few Months

Exilware was first identified on February 2, 2026. The earliest known iteration of BraZetsu dates back to February 9, 2026, while the modular Python framework was observed in early May 2026.

A total of five distinct versions have been identified. The evolution appears to have transformed a relatively simple remote access trojan into a structured platform for collecting, evaluating, and selling access.

The third generation focused more heavily on Brazilian corporate targets. Exilware also advertised access to two compromised hosts in the United States, however, ruling out an exclusively domestic scope.

The primary targets are located in Iberia and Latin America. Exposed sectors include e-commerce, financial institutions, industrial companies, law enforcement, and organizations with valuable infrastructure or data.

The operators are believed to be native Portuguese speakers. The latest versions show particular attention to Brazil while retaining multilingual capabilities that could support campaigns across the region.

How BraZetsu Assesses a Compromised System

Once executed, BraZetsu collects information about the hardware, installed software, and network configuration. It enumerates processes, environment variables, ports, recently opened files, and directories associated with ERP installations.

The framework can also capture screenshots, monitor the active application window, retrieve digital certificates, and execute commands through a remote shell. The operator can upload additional modules and interact with the device manually.

The history collection targets Google Chrome, Microsoft Edge, Brave, Vivaldi, and Opera. Window titles are also checked for keywords associated with banking activity, which may indicate that a victim is particularly profitable.

To maintain a persistent channel with the Infected Marketplace, BraZetsu uses WebSocket connections. The information needed to reach the command-and-control server is retrieved through a Pastebin URL, allowing operators to update the infrastructure without hard-coding it into the malware.

The component described as being AI-based combines the collected data to estimate the host's commercial potential. The system helps Exilware distinguish an uninteresting workstation from a computer with access to payments, corporate networks, certificates, or business applications.

The result is a kind of enriched criminal catalog. Access is not offered as an undifferentiated commodity, but classified according to its potential for fraud or network expansion.

CNAB Files, Payment Processes, and Links to Other Malware

BraZetsu specifically searches for CNAB files, a fixed-width text standard used in Brazil to exchange financial information between companies and banks. Their presence may indicate that a system is involved in managing payments or remittances.

This capability overlaps with CNABHunter, a Python tool designed to find and interpret these documents. CNABHunter can send transaction metadata to a remote server and modify the original files, replacing legitimate data with attacker-controlled bank details, PIX keys, or barcodes.

The two tools serve different purposes, however. CNABHunter specializes in payment manipulation, while BraZetsu conducts broader reconnaissance, maintains remote control, and prepares the host for subsequent sale.

The most significant overlap concerns the list of directories examined to find CNAB files. BraZetsu's developers are believed to have reused this logic after recognizing its value. The framework was identified in the wild the day after CNABHunter was publicly disclosed by the researcher @johnk3r on X.

Another connection involves AgenteV2, a Python backdoor distributed against Brazilian users through fake judicial summonses. The malware can stream the victim's screen in real time, allowing operators to intervene when a banking portal is opened.

The address 38.242.246[.]176, identified while analyzing the naming convention associated with Exilware, had previously been linked to AgenteV2. Shared code, infrastructure, tradecraft, and operational capabilities support with high confidence the assessment that AgenteV2 and BraZetsu are manifestations of the same framework.

The Loader Masquerades as Microsoft Edge

The initial compromise vector has not been determined. Social engineering remains the leading hypothesis, but no complete, verified infection chain is known for all BraZetsu infections.

The observed starting point is a loader presented as Microsoft Edge, downloaded from the domain caixaentradas1inboxshop[.]site. The associated files contain VBS scripts responsible for retrieving the next stage.

The same domain was used to distribute Ousaban, a banking trojan observed in a phishing campaign targeting users on the Iberian Peninsula in May 2026. In that case, a decoy PDF directed the victim to a malicious page that checked the environment and served a VBS file to users in Spain or Portugal.

The chain continued with an executable, a steganographic PNG image disguised as a document, an embedded ZIP file, and an Ousaban DLL. Final execution occurred through DLL sideloading or process injection. The campaign was described in a report published in July.

The shared domain and use of VBS do not prove that Ousaban and BraZetsu are controlled by the same group. They may instead indicate the use of common infrastructure or a shared distribution service.

Indicators and Defensive Priorities

There is no specific patch: BraZetsu is malware, not a product vulnerability. Organizations should block or monitor at least the following indicators:

• caixaentradas1inboxshop[.]site
• infect[.]online
• 38.242.246[.]176
• Pastebin URLs used to obtain C2 configurations
• WebSocket connections to unauthorized infrastructure

The execution of VBS files downloaded from the Internet should be blocked or subject to enhanced controls. Processes that present themselves as Edge but launch scripts or binaries from temporary directories or paths unrelated to the legitimate installation also warrant attention.

EDR and network security systems should look for DLL sideloading, process injection, remote shells, repeated screen captures, and abnormal access to browser histories. Other signals include the enumeration of ERP directories, digital certificates, recent files, and CNAB documents.

Payment workstations require segmentation and stricter controls. Any change to bank details, PIX keys, or barcodes should be verified through an independent channel before the remittance is processed.

Finally, Windows systems should be reviewed for the five known generations of BraZetsu and artifacts associated with AgenteV2. The initial compromise is only the first step: the real objective is to make that access saleable and reusable by other criminals.