A sophisticated Android banking trojan uses real-time AI or human operators to hijack transactions on Brazil’s PIX system, affecting over 150 million users.