Banana RAT Uses Exposed Payload Generator to Create Polymorphic Banking Malware Variants

Cybersecuritynews •Tushar Subhra Dutta • July 8, 2026

Banking malware just got a serious upgrade in how it hides itself from security teams. A campaign built around Banana RAT, a remote access trojan long tied to Brazilian banking fraud, has been caught using an exposed backend server that builds new malware variants on demand. That server did not just host malicious files; it […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Banana RAT Exploits Exposed Server for Polymorphic Banking Malware Creation An exposed server at 198[.]245[.]53[.]26 has been linked to the Banana RAT, a remote access trojan associated with Brazilian banking fraud. This server hosts a payload-generation backend and obfuscation tools, allowing attackers to create new malware variants on demand. The infrastructure includes static files and a FastAPI-based builder, which can generate polymorphic banking malware. The discovery was made via Shodan, highlighting the vulnerabilities in the RAT's operational security. Researchers are now able to analyze the obfuscation techniques used in the malware. The active exploitation of this infrastructure poses a significant threat to financial institutions and their customers. Current assessments indicate that the malware can evade detection by security systems, increasing the risk of successful attacks. The situation remains critical as the server is still active and being utilized for malicious purposes. 2 sources 64

Banana RAT Uses Exposed Payload Generator to Create Polymorphic Banking Malware Variants

The full story

Extracted Entities

Attack Types (1)

Malware (1)