Loading story…
ESET Research reported that the Janeleiro banking trojan had targeted corporate users in Brazil since 2019, using phishing emails that delivered ZIP archives containing MSI installers. Once installed, the malware monitored window titles for banking-related keywords and displayed fraudulent banking pop-up forms designed to steal credentials and facilitate account fraud.
The operators could interact with victims in real time by capturing screens, logging keystrokes, and sending mouse and keyboard input. ESET said Janeleiro differs from many Latin American banking trojans because it is written in Visual Basic .NET rather than Delphi, while still following the fake pop-up model used by families including Casbaneiro, Grandoreiro, Mekotio, Amavaldo, and Vadokrist. The campaign also used GitHub organization pages and daily-created repositories to publish encrypted or plaintext C2 server lists, with newer variants using date-based encryption to limit samples and infrastructure lists to a specific day; GitHub was notified and the malicious repositories were removed.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the GitHub repositories used by Janeleiro operators to publish command-and-control server lists had been taken down by April 6, 2021 after GitHub was notified.
ESET identified Janeleiro versions 0.0.4, 0.0.2A, 0.0.2B, and 0.0.3 between 2019 and March 2021, including 2019-dated samples labeled version 0.0.4 that suggested an unusual internal version timeline.
ESET said the Janeleiro banking trojan has targeted corporate users in Brazil since 2019, affecting organizations across sectors including engineering, healthcare, retail, manufacturing, finance, transportation, and government.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
A high-severity **Casbaneiro** banking-trojan campaign is targeting Microsoft Windows users in Latin America through phishing emails masquerading as invoices and legal notices. The messages deliver a multi-stage infection chain involving an HTA downloader, an AutoIt interpreter and loader, and a final payload injected into legitimate Windows processes such as `RegSvcs.exe` or `mobsync.exe`; persistence is established through a Startup-folder LNK file. The malware activates command-and-control activity after victims visit targeted banking sites and enables financial fraud through clipboard manipulation and fraudulent windows. It also harvests Outlook address-book data and email metadata, sending it unencrypted to multiple attacker-controlled data-receiving servers. Casbaneiro evades analysis through fragmented runtime string decryption and HTTP 403 responses, while avoiding systems configured in German, French, or English; defenders should prioritize blocking the campaign's published malicious domains, IP addresses, and file hashes and investigate suspicious HTA, AutoIt, and Startup-folder activity.
Sep 16, 2026