{"id":333,"date":"2026-03-08T03:55:40","date_gmt":"2026-03-08T03:55:40","guid":{"rendered":"https:\/\/quantusintel.group\/osint\/blog\/2026\/03\/08\/mapping-the-digital-network-of-tropa-do-arranca-inside-a-brazilian-phishing-kit\/"},"modified":"2026-03-08T03:55:40","modified_gmt":"2026-03-08T03:55:40","slug":"mapping-the-digital-network-of-tropa-do-arranca-inside-a-brazilian-phishing-kit","status":"publish","type":"post","link":"https:\/\/quantusintel.group\/osint\/blog\/2026\/03\/08\/mapping-the-digital-network-of-tropa-do-arranca-inside-a-brazilian-phishing-kit\/","title":{"rendered":"Mapping the Digital Network of \u201cTropa do Arranca\u201d: Inside a Brazilian Phishing Kit"},"content":{"rendered":"
\"\"<\/figure>\n

As cybercrime in Brazil continues to grow in sophistication, a group known as \u201cTropa do Arraca\u201d has emerged as a notable threat actor. The group is reportedly involved in stealing mobile devices and then using phishing kits to extract additional digital assets from victims. In this article, we leverage OSINT (Open Source Intelligence) investigation and analysis through the threat hunting platform Criminal IP to examine the group\u2019s infrastructure and malicious operational management, uncovering their complex tactics. We also focus on analyzing specific phishing kits, particularly those targeting iCloud credentials, to understand the group\u2019s level of sophistication better.<\/p>\n

Where the Inquiry Begins: Suspicious Signatures and a Phishing Operation<\/h3>\n

The analysis and investigation into \u201cTropa do Arraca\u201d began with what appeared to be a seemingly ordinary fragment of HTML code. However, upon closer inspection, the code was revealed to be a phishing kit meticulously designed to mimic the iCloud login\u00a0page.<\/p>\n

Within the analyzed source code, the following hidden fields were identified:<\/p>\n

<input id=\u201dAppleAccount\u201d type=\u201dhidden\u201d value=\u201dkittropadoarranc_Tropa\u201d\/><\/p><\/blockquote>\n

\"\"<\/figure>\n

The string \u201ckittropadoarranc_Tropa\u201d found within the field was not a simple error or random identifier. It functioned as a digital signature pointing to \u201cTropa do Arraca,\u201d suggesting a group already known within Brazil\u2019s cybercrime ecosystem. From this point onward, the investigation expanded beyond the analysis of a single phishing kit into a broader effort to track an organized threat\u00a0group.<\/p>\n

Inside \u201cTropa do Arranca\u201d: Reflecting Brazil\u2019s Evolving Cybercrime Scene<\/h3>\n

The term \u201carranca\u201d<\/em> in Brazilian slang refers to forcefully or swiftly taking something away. In the context of cybercrime, \u201cTropa do Arranca\u201d appears to specialize not only in the physical theft of mobile devices, but also in extracting victims\u2019 digital access, particularly iCloud account credentials.<\/p>\n

Their ultimate objectives include:<\/p>\n