Cybersecurity researchers at **Group-IB** have unveiled a sophisticated Python-based Windows malware framework named **BraZetsu**. This advanced toolkit is not merely an infostealer; it serves as a comprehensive 'master toolkit' for Initial Access Brokers (IABs), converting compromised systems into highly valuable commercial assets. "Unlike the standard infostealer model, **BraZetsu** is a comprehensive master toolkit that empowers Initial Access Brokers (IABs) by turning compromised systems into highly valuable commercial assets," stated **Group-IB** malware analysts **Julio Guapo Menezes** and **Miguel Salazar** in their technical report. They further noted its high operational maturity, modular architecture, and stealth techniques, which allowed some samples to evade detection on **VirusTotal** at the time of their analysis. **BraZetsu** is a portmanteau of "Brazil" and "Zetsu," a character from the Japanese Manga series **Naruto**, known for operating from the shadows. This name aptly reflects the malware's stealthy infiltration of target networks for subsequent destructive attacks. The threat actors, identified as **Exilware**, are believed to be native Portuguese speakers. The Singapore-headquartered company reports that **BraZetsu** primarily targets Iberian and Latin American entities across various sectors, including e-commerce, corporate, financial, industrial, and law enforcement. Evidence suggests a significant reliance on generative artificial intelligence (AI) not only for malware development but also for backend data triage and prioritizing high-value targets. ### The Infected Marketplace: Access-as-a-Service **BraZetsu** is the foundation for the **Infected Marketplace** (also known as "Banco de Infects" or "infect[.]online"). This platform allows threat actors to monetize initial access to compromised hosts, with an initial deposit of approximately $5.80. The marketplace was first observed on February 2, 2026, and its associated toolset has rapidly evolved from a basic remote access trojan to the current AI-enhanced intelligence-gathering framework. "By functioning as a service-enabled platform, the marketplace allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect across the regional ecosystem," the researchers explained. This 'access-as-a-service' model enables other criminals to purchase entry points into victims' systems and deploy their own malware or tools without needing to establish the initial foothold themselves.  ### BraZetsu's Capabilities The modular Python framework, first observed in early May 2026, allows operators to catalog compromised systems as "tradable assets" for secondary threat actors on the marketplace. Its functions include: * Scanning infected hosts and using generative AI to triage data, prioritizing high-value targets for IABs. * Collecting digital certificates, browser histories from **Google Chrome**, **Microsoft Edge**, **Brave**, **Vivaldi**, and **Opera**, and financial files, while tracking user behavior through screen captures. * Specifically targeting corporate financial remittance files in the Brazilian Federation of Banks' **CNAB** format, a fixed-width text file standard for electronic data interchange of financial transactions. * Utilizing the **WebSocket** protocol for persistent communication with the **Infected Marketplace**.  ### Overlap with CNABHunter and Delivery Mechanisms **BraZetsu** exhibits some overlap with **CNABHunter**, a custom Python tool that systematically scans for and parses **CNAB** files, exfiltrating payment metadata. **CNABHunter** can also rewrite original **CNAB** files, replacing legitimate payment information with attacker-controlled banking details, **PIX** keys, or barcodes to facilitate financial fraud. While **BraZetsu** is primarily focused on initial access and broad host reconnaissance, it incorporates the **CNAB** file-locating functionality, likely due to observing the profitability of **CNABHunter**. This assessment is supported by the fact that **BraZetsu** appeared in the wild shortly after **CNABHunter** was publicly discussed by researcher **@johnk3r** on **X**.  The exact delivery method for **BraZetsu** remains unclear, but social engineering is suspected. The initial infection often begins with a loader disguised as **Microsoft Edge**, downloaded from a distribution domain such as "caixaentradas1inboxshop[.]site." Analysis of files associated with this domain revealed Visual Basic Script (**VBS**) files responsible for downloading subsequent attack stages. This same domain has also been linked to the delivery of the **Ousaban** banking trojan. **Fortinet FortiGuard Labs** reported in May 2026 an email phishing campaign targeting the Iberian Peninsula with an **MSI** downloader that deployed **Ousaban**. "The phishing PDF tricks victims into visiting a malicious webpage that scans the user's environment," **Fortinet** detailed in a July report. "If they are in Spain or Portugal, the webpage downloads a **VBS** file to kickstart the next part of the attack. The final payload is an **EXE** file that is dropped onto the victim’s computer and executed by the **VBS** script."  Similar to **Ousaban**, **BraZetsu** uses a **Pastebin** URL to extract C2 information. It includes functions to obtain the active application window title (checking for banking keywords), enumerate environment variables, network ports, and running processes, execute shell commands, capture screenshots, fetch recently opened files, and locate common Enterprise Resource Planning (**ERP**) installation directories. To date, five distinct versions of the malware have been observed in the wild, with the earliest iteration dating back to February 9, 2026. The third generation is particularly notable for its refined target prioritization.