A technology security company says it has uncovered a massive cybercrime ring in Brazil that may have stolen billions of pounds from a widely used online payment system.