Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024. Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as "specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers." The adversary

The article reports that the financially motivated threat actor Breeze Comet is manipulating Brazilian payment systems and banking software to execute hundreds of fraudulent transactions, targeting financial services, retail, and e-commerce organizations since 2024. These facts indicate systemic weaknesses in digital financial workflows and potential exploitation of automated decision or transaction-processing logic, even if AI is not explicitly mentioned. From a RealGround perspective, such attacks highlight the need to assess how AI-powered or automated payment and fraud-detection systems might be subverted or bypassed, and to harden business logic around transaction initiation and authorization. Organizations should conduct readiness assessments and detailed audits of agent-like automation and rules engines in their fintech stack to ensure robust controls, monitoring, and abuse-resistant logic.