Python Malware Framework Powers Underground Marketplace Selling Hacked Computers

Cybersecurity researchers have uncovered a sophisticated Python-based Windows malware framework named BraZetsu that powers an underground marketplace selling access to hacked computers for as little as $5.80, according to a technical report published by Group-IB. The framework transforms compromised systems into tradable commercial assets for Initial Access Brokers rather than following the standard infostealer model. Some samples remained completely undetected on VirusTotal when researchers analyzed them, demonstrating the malware's operational maturity through modular architecture and stealth techniques.

The malware primarily targets victims in Iberian and Latin American regions across e-commerce, corporate, financial, industrial, and law enforcement sectors, according to Group-IB. The threat actors behind it, tracked as Exilware, are believed to be native Portuguese speakers who were first discovered on February 2, 2026. The modular Python framework itself appeared in early May 2026, rapidly evolving from a basic remote access trojan to an AI-enhanced intelligence-gathering system. BraZetsu scans infected hosts and uses generative AI to triage data and prioritize high-value targets, while collecting digital certificates, browser histories from Chrome, Edge, Brave, Vivaldi, and Opera, financial files, and screen captures. The malware specifically hunts for corporate financial remittance files in the Brazilian Federation of Banks' CNAB format, a fixed-width text file standard used for electronic data interchange of financial transactions between companies and banks in Brazil.

The malware supports the Infected Marketplace, also known as "Banco de Infects" or "infect[.]online," where criminals can purchase entry points into victims' systems and remotely execute secondary malicious payloads on purchased access without establishing the initial foothold themselves. "By functioning as a service-enabled platform, the marketplace allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect across the regional ecosystem," malware analysts Julio Guapo Menezes and Miguel Salazar wrote. The researchers identified five distinct versions of the malware in the wild to date, with the earliest iteration dating back to February 9, 2026. The third generation notably narrowed its operational focus to corporate targets in Brazil, though the threat actor has been observed advertising access to two compromised hosts located in the U.S. around the same time.

The report explains that BraZetsu's AI-driven assessment capabilities automatically evaluate compromised machines' commercial potential through hardware profiling, software environment analysis, and network infrastructure mapping, enabling Exilware to automatically categorize and price marketplace access based on victim value. The malware maintains persistent communication with the Infected Marketplace through the WebSocket protocol, while supporting both autonomous data collection and interactive hands-on operations through remote shell command execution. Evidence points to heavy use of generative AI not just for malware development but also for backend data triage and target prioritization. The malware incorporates dedicated functions to obtain the user's active application window title and capture screenshots if it contains common banking keywords, enumerate environment variables and running processes, fetch recently opened files, and locate common Enterprise Resource Planning installation directories. BraZetsu shares overlap with CNABHunter, a custom Python tool that systematically scans for CNAB files, and researchers suspect the developers incorporated the same functionality after seeing a profitable opportunity, since BraZetsu was discovered in the wild a day after CNABHunter was publicly disclosed by a researcher on X.

Group-IB assessed with high confidence that BraZetsu refers to the same initial access malware framework as AgenteV2, a Python-based backdoor that previously targeted Brazilian users via phishing lures impersonating judicial summons, based on shared codebase, tradecraft, infrastructure, and functional capabilities. Recent versions show an exclusive focus on Brazilian infrastructure while maintaining multi-language capabilities for regional expansion, indicating deep operational knowledge of the domestic threat landscape and strategic positioning for broader Latin American operations targeting critical infrastructure and high-value commercial sectors. The malware's delivery method remains unclear but social engineering is the most likely culprit, with a loader masquerading as Microsoft Edge downloaded from a distribution domain that has also been used to deliver the Ousaban banking trojan. For organizations facing this threat, the combination of AI-enhanced target selection and a marketplace model that enables secondary attacks represents a fundamental shift in how initial access transforms into sustained financial fraud campaigns. The access-as-a-service operation creates a force multiplier where a single compromise can spawn multiple distinct attack vectors, each tailored by different criminal buyers to their specific objectives and expertise.