Loading story…
Brazilian banking malware has evolved from basic keyloggers and phishing Trojans into more sophisticated toolsets that use obfuscation, encryption, process injection, browser automation, remote administration, and even ransomware techniques. Researchers said operators adapted quickly to banking defenses such as virtual keyboards, machine fingerprinting, and two-factor authentication by shifting to mouseloggers, hosts-file redirection, Internet Explorer automation, RunPE-style loaders, AutoIt and .NET crypters, and live operator-controlled remote access Trojans, with code quality and operational tradecraft improving markedly over time.
One delivery method highlighted in later activity used malformed ZIP archives prefixed with a UTF-8 Byte Order Mark to evade some email scanners and make the files appear corrupted to certain tools while remaining extractable with common utilities. The recovered loader decrypted an embedded DLL from its resources with an XOR-based routine, executed the exported function BICDAT, then fetched a second-stage password-protected ZIP that delivered a Banking RAT seen broadly in Brazil and Chile, underscoring how Brazilian cybercriminals combined local banking fraud expertise with increasingly advanced malware packaging and execution chains.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The Securelist article states that McAfee published reporting in 2013 on a malware delivery technique that prepended a UTF-8 Byte Order Mark to ZIP archives. The technique had been used by Russian gangs to distribute malware capable of modifying the Windows hosts file.
Securelist reports a Brazilian spear-phishing campaign that used ZIP archives prefixed with a UTF-8 BOM to evade some scanners and appear corrupted in default Windows handling while remaining extractable by WinRAR and 7-Zip. The extracted loader decrypted an embedded DLL, executed its exported function "BICDAT," downloaded a second password-protected ZIP, and ultimately installed a Banking RAT variant widespread in Brazil and Chile.
Securelist describes Brazilian banking malware as evolving from early Delphi and Visual Basic 6 keyloggers and plaintext-configured phishing Trojans into more sophisticated malware using mouselogging, browser automation, obfuscation, encryption, process hollowing, .NET tooling, and operator-driven RAT capabilities. The evolution was driven in part by banks introducing defenses such as virtual keyboards, machine identification, and two-factor authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
Researchers detailed **Zumanek**, a Brazilian banking malware family that uses a multi-stage infection chain to steal credentials from victims of online banking and cryptocurrency services. The malware was observed almost exclusively in Brazil and begins with a socially engineered downloader that verifies the system is configured for Brazilian Portuguese, checks for installed security products, retrieves a ZIP payload from its command-and-control infrastructure, and launches the final banker and remote-access trojan stage. The final payload abuses **DLL hijacking** by pairing a legitimate signed executable with a malicious DLL, then establishes persistence, injects into `notepad.exe`, and redirects targeted banking activity into Internet Explorer for credential theft through form grabbing. Zumanek communicates with its C2 over HTTP POST requests and multiple sockets, and supports a broad set of remote-control functions including screenshots, browser manipulation, and actions associated with keylogging, underscoring continued evolution in Brazilian financial malware.
Aug 14, 2026
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026