Neobanks, FinTech and PSPs, October 2026

Monthly reference modules

These modules are filled automatically with verified dated facts from the period. Each one states its base and counting criterion, so the figures reconcile across modules. They are the recurring month-by-month reading; the analysis that follows expands on the cases without repeating this summary.

Indicator window: 56 dated facts in October 2026 · 2 from prior months (comparative frame, not monthly volume) · 5 without confirmed date (excluded from the indicators). Facts from prior months are used only as a comparative frame in the analysis, never as volume for this period.

Executive summary

The period under review was dominated by a highly visible incident in the region’s crypto-financial ecosystem: the Binance case, which triggered temporary withdrawal blocks, a preliminary investigation into the possible compromise of a laptop used by a DevOps engineer, and a containment response that included asset freezes, revocation of authorizations, and coverage of losses through company funds and SAFU. Although some media coverage put the estimated impact at USD 6.300 billion, the report should treat that figure as an estimate of financial impact, not as an independent measure of the amount actually stolen. The operational reading matters more than the headline: the company said it found no evidence of private key leakage and continued providing unaffected services while it resumed withdrawals after verification.

Beyond the Binance episode, the period showed a consistent pattern of pressure on financial infrastructure in Latin America: phishing, social engineering, credential theft, API abuse, and cloud environment compromise continued to surface as dominant vectors. The Central Bank of Brazil reported 99 cyber incidents in the financial system through September 2026, with fraud accounting for most of them and a diagnosis pointing to the combination of valid credentials, privilege escalation, and automation of fraudulent transactions. In Mexico, data attributed to Banco de México pointed to at least eight incidents between January and May 2026, with losses of more than 120 million pesos for affected companies and the explicit presence of an electronic payment fund institution among the reported cases.

The region also showed signs of industrialized digital fraud. In Colombia, ShadowParasite expanded its inventory to 288 malicious domains impersonating 47 brands, including banks, digital wallets, and payment collectors. At the same time, fake-message campaigns tied to Bre-B kept exploiting user confusion over keys, pending transfers, and credential management. In Brazil, reporting on SLIM SPIDER and the cloud infrastructure used by a financial institution pointed to a supply-chain and credentials vector that remains especially sensitive for banks and fintechs that depend on technology vendors.

For CISOs and risk leaders, the message from this period is clear: the real perimeter is not the brand, but identity flows, transfer automation, API management, credential hygiene, and third-party oversight. The attack surface of neobanks, fintechs, and PSPs remains hybrid, combining cloud, employee endpoints, digital certificates, third-party integrations, fraudulent messaging, and real-time operations. Effective defense requires strong access controls, transaction monitoring, function segmentation, rapid token revocation, anomaly detection, and response exercises that do not assume the incident will be linear or immediately visible.

Overview

The period’s snapshot does not point to a single dominant attack pattern, but to a convergence of techniques aimed at the same target, monetizing access to digital financial systems. At one end are high-profile cryptoasset incidents, where attackers seek to move large sums across multiple blockchains and the affected organization responds with freezes, partner coordination and, when possible, partial operational rollback. At the other end are more persistent, less visible campaigns built on phishing, brand impersonation, credential theft and abuse of internal processes to execute transfers or capture financial data.

The period’s reporting supports an operational conclusion, criminals do not necessarily need to break the most visible layers of a system if they can exploit identity. That is evident in the Brazilian Central Bank’s assessments, which describe cases involving valid credentials, privilege escalation and automated fraudulent transactions. It also appears in coverage of ShadowParasite, which exploits user familiarity with banks, wallets and collectors to steer victims to fake portals, and in campaigns tied to Bre-B, where the entry point is user confusion over the status of a transfer or a payment key.

Cloud providers and technology vendors are taking a more central place in the region’s risk profile. The Brazilian case attributed by CrowdStrike to SLIM SPIDER, although it does not publicly identify the affected institution or confirm successful transfers or financial losses, illustrates an attack path that no longer stops at the end user or the cash register, it targets temporary credentials, cloud environments, private keys and digital certificates. This matches the Brazilian Central Bank’s warning that, in some incidents, unauthorized access to a technology provider’s environment allowed attackers to obtain private keys tied to a digital certificate used by a contracting institution.

At the same time, banking fraud and malware campaigns continue to adapt. The Hacker News reported activity by banking trojans such as Grandoreiro and BTMOB against Latin America and Europe, suggesting that the classic malware layer still coexists with more sophisticated AI-driven automation operations, such as those attributed to CyberCartel. In defensive terms, that means stopping thinking in separate buckets, "fraud," "phishing," "ransomware," "banking malware," "cloud compromise," as if they were isolated silos. In practice, attackers combine vectors and shift surfaces depending on friction.

The regional picture also shows meaningful regulatory differences. Brazil is moving toward an authorization and transition framework for virtual asset providers, with rules on segregation, reserves, audits, AML, cybersecurity and limits on operating with unauthorized providers. Colombia, meanwhile, is dealing with an identity-fraud and brand-impersonation ecosystem that remains highly active, while Mexico continues to face pressure on financial institutions that operate with electronic payments and SPEI. The result is a region with similar risks, but uneven regulatory responses and, therefore, different levels of defensive maturity.

The period should therefore be read as a warning about the operational resilience of the digital financial system. The problem is not only that attacks exist, but that many of them rely on normal business frictions, remote onboarding, privileged access, third-party integrations, instant payments, transactional messaging and the need to operate at high speed. The more automated the business becomes, the more valuable the ability to stop, audit and reverse transactions without causing a broader service degradation.

Indicators

The period indicators remain the basis of the report and should not be reinterpreted outside their time window. When an indicator says 0, it means it did not appear in the material analyzed for the period, not that the phenomenon does not exist in the region. This is especially important in categories such as CVEs or certain attack families, where absence in the corpus does not equal real-world absence of exploitation.

• Confirmed incidents at Argentine neobanks, fintechs and PSPs in October 2026: 0 in the material analyzed; no cybersecurity incident was identified in October 2026 against an Argentine neobank, fintech or payment processor. The result referring to Argentine fintechs concerns investments and projections, not an attack or leak.
• Confirmed incidents in the Brazilian financial system through September 2026: 99 records, 68 of them classified as fraud. This figure corresponds to the diagnosis released by Brazil's Central Bank and should not be combined with incidents from other countries as if they were the same database.
• Incidents attributed to the Mexican financial system between January and May 2026: at least 8, with losses above 120 million pesos for the affected companies. The coverage broke the cases down into banks, Sofipos, a savings and loan cooperative and an electronic payment funds institution.
• ShadowParasite malicious domains in Colombia: 288 fake domains impersonating 47 brands, including banks, digital wallets and payment collectors. This telemetry describes identified fraudulent infrastructure, not individually confirmed victims.
• Mercado Pago incidents in Chile during the period: 1 approval anomaly in Point, identified on October 16, 2026 and resolved 23 minutes later, according to the status log consulted.
• Phishing cases and fake messages about Bre-B in Colombia: multiple campaigns and reports during the period, with no single verifiable figure that would allow a consolidated count of victims or confirmed incidents.
• CVE / confirmed critical exploitation in the material analyzed for the period: 0 confirmed records in the provided corpus. This does not mean critical vulnerabilities were not exploited in the region, only that there is no consolidated evidence in the material available for this report.

Incidents

Binance: temporary freeze, partial lockup, and dispute over the true scope of the impact

The period’s most significant incident was Binance, both for its potential scale and the operational response it triggered. The company said its preliminary investigation pointed to a possible compromise of a DevOps engineer’s laptop, from which the attacker may have accessed a service container and sent unauthorized withdrawal transactions. The company said it found no evidence that private wallet keys were leaked, a key distinction because it narrows the presumed compromise. At least based on confirmed information, this was not a demonstrated breach of the central custody of keys, but an access path into an operating environment with the ability to generate transactions.

The public timeline followed a familiar pattern for a high-pressure financial incident. Reports first surfaced about a hack and a temporary suspension of withdrawals. Binance then said it had frozen about USD 3 billion in affected assets through coordination with blockchain partners, revoked authorization for the address involved, and worked with law enforcement and blockchain intelligence firms. It also said it would cover losses through the Secure Asset Fund for Users (SAFU) and corporate funds, while unaffected deposits and services remained operational and withdrawals resumed after checks.

That response matters for two reasons. First, it shows a containment model that is becoming more common in crypto finance: detecting the diversion is not enough, you need a network of partners able to trace and freeze assets quickly before the attacker can spread or mix them. Second, it shows that incident management has also become a test of public trust. In cases like this, perceived solvency and control matter as much as forensic capability. Coverage in Argentina and Bolivia focused on the withdrawal freeze and the promise to cover losses, which shows the region’s interest in the direct impact on retail users.

Public debate over attribution was less straightforward than the impact narrative. BleepingComputer reported that Binance had identified additional points of compromise and that the investigation was ongoing, without the company officially linking the incident to a threat group. Other coverage, cited by regional media, attributed the attack to TraderTraitor or to North Korea, but those attributions should be read cautiously because several were presented as estimates or third-party reports, not as independent confirmation from the company. For the purposes of this report, what can be verified is the existence of an incident, the hypothesis of a compromised DevOps engineer laptop, and the response of freezing assets and covering losses.

The operational takeaway for CISOs is clear: in high-volume transaction environments, a compromised privileged endpoint can be enough to turn an apparently robust environment into a source of unauthorized withdrawals. Perimeter controls matter less if an attacker can act from an internal session with valid, even if limited, access. For that reason, the most useful defenses are not just entry barriers, but a combination of strict privileged endpoint management, function segmentation, stronger approval for sensitive actions, and anomaly detection on containers and internal services.

A second lesson is that outside freeze capability does not replace internal resilience. If Binance was able to immobilize part of the affected value, it was because there is a collaborative network with blockchain providers, but that does not remove the need for every exchange and every PSP to have its own containment playbooks, permission revocation processes, risk address alerts, and coordination with compliance and legal. In the Latin American context, where end users often operate through mobile apps and can move funds between platforms very quickly, the reaction window is minimal.

Operational takeaways for the regional ecosystem

The Binance case also has a regional spillover effect. In Bolivia, Red Uno explained that the relevance of the incident for Bolivian users was tied to the platform’s use in the country and to the framework enabled by the Central Bank of Bolivia for the use of electronic payment instruments in virtual asset transactions. The coverage also made clear that there was no official figure for Bolivian user funds or for any possible losses in Bolivia. That distinction is useful: the risk is real because of user exposure, but there is no basis to infer local amounts without direct evidence.

What a PSP or exchange CISO should review

• Access control for privileged DevOps and operations endpoints.
• Strict separation between administrative workstations and day-to-day use.
• Monitoring for anomalies in containers, internal services, and withdrawal movements.
• Stronger approval rules for address changes, whitelists, and tokens.
• Playbooks for freezing, revocation, and coordination with tracing partners.
• Mechanisms to communicate with users without causing panic or promising outcomes that do not depend only on the company.

Brazil: record incident volume, fraud dominance, and infrastructure lessons

The Central Bank of Brazil reported 99 cyber incidents in the financial system through September 2026, compared with 76 in all of 2025. Even though the incident count rose sharply, the regulator said the events did not affect the operation of the national financial system. That distinction matters because it separates two different realities: relevant incidents and systemic continuity. A rise in reports does not necessarily mean a service crisis, but it does show sustained pressure on institutions and providers.

The most useful detail for defense is not just the volume, but the breakdown. Of the 99 cases, 68 were classified as fraud. The diagnosis communicated by the Central Bank, and expanded by economic press coverage, describes a troubling mix: compromise of computer environments, misuse of valid credentials, privilege escalation, and automation of fraudulent transactions. In other cases, unauthorized access to a technology provider’s environment made it possible to obtain private keys tied to a digital certificate used by a contracting institution.

That combination reveals an attack structure that is highly adapted to modern financial systems. The attacker does not always need noisy malware or high-profile vulnerabilities. They can combine stolen credentials, API abuse, and poorly segmented internal processes to operate within legitimate business flows. For that reason, the Central Bank also described preventive measures that included temporary limits on operations and replacement of digital certificates when it identified a similar risk at other institutions. The decision to interrupt or limit an operation is uncomfortable, but it is often the only way to prevent exploitation from turning into fraud at scale.

Coverage by O Globo added a particularly relevant detail: some attackers obtained passwords from employees, developers, and vendors through phishing, and in other cases exploited APIs to trigger transfer orders without going through normal approvals. That observation reinforces a central point from the period: the API is a business asset, but it is also a failure point if it is not audited with the same rigor as a core system. In many environments, automation is designed for efficiency; the problem appears when hard limits are not preserved between a received instruction and an irreversible operation.

Implications for banks, fintechs, and PSPs in Brazil

Brazil appears to be a market where risk is not split between "large banks" and "small fintechs." The digital supply chain connects them all. Cloud, certification, messaging, identity, and transaction orchestration providers become shared points of compromise. A vulnerability in a provider or poor credential management can become an incident for a contracting institution without the attacker ever touching the front-end app.

The regulatory reading reinforces that point. Brazil approved Joint Resolution 21, which requires specific customer consent for each associated company receiving Open Finance data, strengthens oversight of those partners, and provides for stopping data sharing when a security risk exists. Although this resolution is not itself an incident, it does signal that the regulator is shifting part of the control to the point where information is shared. For a CISO, the message is direct: risk does not end in the banking core. It continues with every partner that receives data, accesses APIs, or runs downstream processes.

What a CISO in Brazil should prioritize

• Auditing high-impact APIs and detecting unusual automation.
• Rotating and protecting human and service credentials.
• Segmentation between development, operations, and provider environments.
• Replacement and strict control of digital certificates.
• Review of third parties with access to cloud and secrets.
• Monitoring for atypical transfers and privilege changes.

Colombia: ShadowParasite, Bre-B, and the industrialization of identity fraud

Colombia’s landscape during the period shows a different dynamic, but no less dangerous. Lumu reported the ShadowParasite operation, with 288 fake domains impersonating 47 brands, including banks, digital wallets, and payment collectors. Semana added that the inventory had grown from 51 to 288 domains, along with 246 IP addresses and 29 autonomous systems, suggesting a broader fraud infrastructure than initially appeared. Scale matters because it shows persistence and renewal capacity: this is not a single fake site, but an infrastructure ecosystem built to capture credentials, personal data, and payments.

The nature of the fraud matters for PSPs and neobanks. The pages impersonated financial entities and payment services to capture personal data, credentials, and payments. That means the goal is not only credential theft, but immediate monetization of trust. The user believes they are confirming a payment, updating a key, or resolving a problem with their account, when in reality they are handing information to a fraudulent operator. This type of campaign is especially effective where digital banking and instant payments are becoming routine.

Coverage of Bre-B points in the same direction. Infobae said fraudulent messages refer to key registrations or pending transfers and lead to fake portals that request credentials, verification codes, or other personal data. Blu Radio, citing an explanation from the Banco de la República, noted that transfers through Bre-B do not require recipient acceptance and that the system does not have a separate app to manage keys; management must be done through the bank or the relevant financial institution. That clarification is key because part of the fraud rests on confusing users about how the system works.

The combination of those two elements, impersonation infrastructure and misleading messages about the payment process, suggests that fraud in Colombia operates as a full chain. First, an expectation is created through a message or fake portal. Then the credential or code is captured. Finally, monetization is attempted through the account or payment method. In that sense, blocking domains is not enough. Users also need to be educated on the logic of the legitimate flow, and above all, the entity’s own messages need to be designed so they are not easily imitated.

Operational view for banks and wallets in Colombia

In Colombia, the challenge for security and antifraud teams is twofold. On one side, they must deal with the fraudulent infrastructure that impersonated 47 brands. On the other, they must solve the UX and trust problem: if the user cannot tell a real flow from a fake one, the entire system is exposed. Defense should include protected domains, impersonation observability, monitoring of SMS and email campaigns, and authentication interfaces that are clear to the customer.

What a CISO in Colombia should review

• Early detection of impersonation domains and subdomains.
• Antifraud messaging in SMS, email, and push that explains the correct flow.
• Protection of keys, codes, and registration processes in official channels.
• Rules for validating links and redirects to financial portals.
• Monitoring for mule-account patterns and abuse of instant payments.
• Coordination with customer service teams to shut down the deception quickly.

Mexico: incidents at banks, Sofipos, and an electronic payment funds institution

In Mexico, data attributed to Banco de México show at least eight cybersecurity incidents between January and May 2026, with losses above 120 million pesos for the affected companies. Additional coverage broke those cases down into four banks, two Sofipos, one savings and loan cooperative, and an electronic payment funds institution. The fact that an electronic payment funds institution appears in the breakdown is particularly important for this report, because it directly connects the risk to the digital payments segment, not just traditional banking.

The available information does not publicly identify all the institutions or detail the same level of impact for each one. In addition, one report said the losses for the electronic payment funds institution had not been determined. That caution should be preserved. Even so, the data set still supports the conclusion that the Mexican ecosystem remains an attractive target for credential abuse, intrusion into repositories, exploitation of processes, and monetization of financial data.

During the same period, a series of reports on CyberCartel expanded regional concern. Straiker said the group used an artificial intelligence agent system called CARLIY0S to coordinate attacks against more than 400 financial targets in Latin America, including banks and payment providers. Several reports also said credentials, API keys, and SPEI-related data were present, although without confirming that all target entities had been successfully breached. Prudence is essential here: the number of targets does not equal the number of confirmed victims.

The useful takeaway for Mexico is that the digital banking and payments ecosystem faces pressure from two sides at once. On one side, real incidents with losses already counted in the financial system between January and May. On the other, artificial intelligence campaigns and credential collection that expand the threat surface, even if they do not always result in confirmed compromises. The practical consequence is that defensive teams need to prioritize not only intrusion detection, but also the protection of credentials, secrets, and payment data that could enable later fraud.

What a CISO in Mexico should watch

• Separation of administration credentials and transactional operations credentials.
• Detection of exposed credentials in repositories or internal inventories.
• Monitoring for unusual access patterns to SPEI and payment systems.
• Mandatory rotation and management of secrets, API keys, and tokens.
• Review of activity at providers and data repositories.
• Playbooks for incidents where it is not immediately clear whether there was exfiltration or transfer manipulation.

Mercado Pago in Chile: a brief anomaly, but a useful operational reminder

Mercado Pago recorded an approval anomaly affecting Point in Chile. The incident was identified on October 16, 2026 and marked resolved 23 minutes later, according to the status record consulted. At first glance, that duration may seem minor compared with other incidents in the period, and that is exactly why it is interesting: it shows that even in relatively mature services, a brief anomaly can affect the user experience and require a transparent status response.

There is no indication in the available material that the anomaly turned into a broader breach, exfiltration, or prolonged incident. Even so, this type of event serves as a reminder that PSPs operate on systems where a failed approval, a short outage, or anomalous behavior at a point of sale can have an immediate commercial impact. The risk here is not only data leakage, but also partial interruption of the payment flow.

For a CISO, the lesson is that service status and public observability mechanisms are part of control. When a platform reports an anomaly quickly and marks it as resolved, it reduces uncertainty and prevents a minor issue from becoming a reputational crisis. In payments, communication speed is also a form of containment.

Brazil and the threat to providers and cloud: the SLIM SPIDER case as a trend signal

CrowdStrike reported that the group known as SLIM SPIDER allegedly compromised the cloud infrastructure of a Brazilian financial institution in late March 2026 to obtain credentials and information related to digital assets. The institution was not publicly identified, and it was not confirmed that Pix transfers had been executed or that there were financial losses. Although the data do not allow for a named confirmed victim, they do point to an intrusion method that deserves attention: access to a provider’s cloud or operating environment to obtain reusable secrets.

TNH1 and BPMoney, summarizing the same investigation, added that the group allegedly used custom scripts to capture temporary cloud access keys. That detail matters because it suggests operational knowledge of the environment and an attack adapted to federation mechanisms, temporary tokens, and short-lived secrets. For a fintech or PSP, that means traditional rotation is not enough if temporary tokens or credentials are not protected by telemetry and identity correlation.

The lesson, however, should be stated cautiously. The only primary source on the case remains a vendor technical reference, and the affected institution was not identified. For that reason, the episode should not be used to claim a statistical trend about losses or attack success. What can be said is that financial cloud infrastructure is a plausible target and that exploitation of temporary credentials is a vector consistent with the rest of the period.

Implications for cloud security

• Isolating temporary secrets and auditing their use.
• Treating cloud credentials as high-value assets.
• Monitoring the issuance, use, and revocation of tokens.
• Reviewing permissions in pipelines, containers, and automation.
• Requiring security evidence from third parties that operate financial infrastructure.

Context briefs: fraud, malware, and cross-pressure in the region

The Hacker News reported on banking trojan campaigns aimed at Latin America and Europe, with Grandoreiro and BTMOB used to infect Windows and Android devices, respectively. This data does not describe a single local incident for neobanks or PSPs in the month, but it helps frame the environment: banking malware is still active and continues to be a useful companion for credential theft, transaction diversion, and session capture.

At the same time, PressPeru’s regional report for the first half of 2026 said phishing and social engineering accounted for an average of 23.66% of regional alerts, while malicious downloaders accounted for 14.94%. That telemetry should not be confused with confirmed incidents, but it does show which techniques are generating noise and defensive load in the region. The same report also described the presence of infostealers and banking trojans adapted to transaction systems and payment platforms in different Latin American countries.

The combined message is that malicious actors move easily across layers: from a fraudulent message to a network of domains, from there to a credential stealer, then to a valid session, and finally to a financial operation. To defend against that chain, teams need to treat it as continuous and avoid separating "user fraud" from a "security incident" too sharply. In practice, one enables the other.