Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

A newly identified threat actor, known as Slim Spider, has been linked to attacks on Brazilian financial institutions since at least March 2026. This financially motivated group is being tracked by CrowdStrike, which has observed the actor's deep understanding of Brazil's financial infrastructure. The target of these attacks includes instant payment systems, with the goal of stealing crypto custody secrets from these institutions. Slim Spider's activities are focused on Brazilian targets, indicating a specialized focus on this region's financial sector. The group's operational knowledge suggests a high degree of familiarity with the inner workings of Brazilian financial systems. CrowdStrike's tracking of Slim Spider is aimed at understanding the group's tactics and motivations.