Loading story…
Researchers detailed JanelaRAT, a remote access trojan repurposed from BX RAT that is designed to monitor and manipulate victim windows tied to banking and other financial activity, with targeting focused on LATAM fintech users. The malware repeatedly checks the active foreground window title against a command-and-control supplied list stored in kepler186f.txt; when a matching window appears, it opens a socket and enables attacker actions including alerting, keylogging, mouse-click capture, screenshot collection, and remote desktop interaction. It also profiles infected hosts, tracks mouse activity and general system usage, and can display attacker-controlled message boxes to support fraud and social engineering.
JanelaRAT also includes mechanisms to interfere directly with user activity during financial sessions. A local file named block.blq identifies windows the operator wants closed, after which the malware issues WM_CLOSE and shows fake error dialogs to the victim to disguise the disruption. Researchers said the malware supports a broad command set for shutdown, UI manipulation, hook removal, and temporary blocking modes, and noted that its Portuguese-language strings and feature set strongly indicate it was built to facilitate financial fraud and user deception.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz published technical analysis of JanelaRAT, a repurposed BX RAT variant focused on banking and financial fraud, including window monitoring, blocking, host profiling, and operator-controlled actions. The analyzed sample contains a hardcoded version string of 1.0.6.4 and targets banking and cryptocurrency-related windows.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **JanelaRAT**, a Latin America-focused banking trojan derived from **BX RAT**, is actively targeting online banking and cryptocurrency users, with the heaviest activity in **Brazil** and **Mexico** and additional campaigns observed in **Chile** and **Colombia**. Kaspersky said it recorded **14,739 detections in Brazil** and **11,695 in Mexico** during 2025, as the malware continued to evolve from earlier VBScript-and-ZIP delivery chains to newer phishing-led infections using **MSI droppers**, **DLL sideloading**, obfuscated **.NET** payloads, and persistence through **Startup-folder LNK files**. Recent activity also included deployment of a malicious Chromium extension disguised as legitimate software. Once installed, JanelaRAT monitors browser and window titles for hard-coded banking and financial targets, then opens interactive **TCP** and **HTTP** command-and-control channels to support screenshots, keylogging, input injection, cursor control, remote command execution, and session hijacking. The malware uses encrypted strings, anti-analysis checks, daily rotating dynamic DNS infrastructure, and user inactivity monitoring to evade detection and help operators time fraudulent transactions. A notable feature is its overlay system, which displays fake banking prompts and Windows update screens to steal credentials and **MFA** tokens while suppressing user interaction.
Jun 29, 2026
Threat actors used an AI-generated typosquatting site impersonating a Brazilian bank to deliver **SmartRAT**, a PowerShell-based banking trojan built for financial theft. Victims were funneled through a fake Cloudflare CAPTCHA and then a fullscreen fake BSOD/system recovery page that pressured them to paste and run a malicious PowerShell command, which fetched additional payload stages from attacker-controlled infrastructure. Researchers linked the campaign to delivery from `64.95.13.238`, command-and-control at `windowsupdate-cdn[.]com`, and a fallback IP of `162.141.111.227`. Once installed, SmartRAT established encrypted raw TCP communications over port `51888`, persisted through scheduled tasks, registry Run keys, and optionally a Windows service named **MicrosoftEdgeUpdateCore**, and could run with elevated privileges while still interacting with the user session. The malware monitored Brazilian banking, payment, and cryptocurrency windows, used keylogging and fake bank-branded overlays to steal credentials, and supported QR-swap fraud by replacing on-screen banking QR codes with attacker-controlled images. It also provided full RAT capabilities including screen streaming, file exfiltration, clipboard manipulation, process and service listing, arbitrary PowerShell execution, and input freezing; researchers additionally found the web-based SmartRAT control panel had a critical authentication weakness, relying on client-side `localStorage` checks without server-side validation.
Jun 29, 2026
Elastic Security Labs disclosed **TCLBANKER**, a Brazilian banking trojan assessed as a major evolution of the **MAVERICK/SORVEPOTEL** family, delivered through a trojanized MSI installer for Logitech's signed **Logi AI Prompt Builder** and executed via DLL sideloading. The malware targets **59** Brazilian banking, fintech, and cryptocurrency services, using anti-analysis checks, environment-gated payload decryption, ETW patching, watchdog functions, and .NET Reactor-protected modules to evade detection and maintain execution. Once active, it monitors browser activity through UI Automation and opens a WebSocket command-and-control channel when victims visit monitored financial sites. The malware's fraud tooling includes a **WPF full-screen overlay** framework that can present fake login prompts, counterfeit Windows Update screens, vishing wait pages, and screen-capture-resistant overlays to steal credentials and support operator-driven account takeover. A separate worm component propagates through **WhatsApp Web** by hijacking authenticated browser sessions and through **Microsoft Outlook** by using COM automation to send phishing emails from the victim's own account. Researchers said the campaign relies heavily on **Cloudflare Workers** for payload hosting and C2, and appears to be in an early operational stage based on exposed developer artifacts and unfinished phishing infrastructure.
Jun 29, 2026