Exposed Banana RAT Infrastructure Reveals Payload Generator and Obfuscator Tooling

Gbhackers •Mayura Kathir • July 8, 2026

A publicly indexed server at 198[.]245[.]53[.]26, discovered via Shodan, exposed more than simple staging files it revealed an active payload-generation backend and obfuscation tooling tied to two distinct Banana RAT branches. The host served static stages (st.txt, payload.php) and a FastAPI-based builder (servidor_completo_pool.py) plus an ofuscador.py helper. Enabling researchers to compare an older ETW-themed branch […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Banana RAT Exploits Exposed Server for Polymorphic Banking Malware Creation An exposed server at 198[.]245[.]53[.]26 has been linked to the Banana RAT, a remote access trojan associated with Brazilian banking fraud. This server hosts a payload-generation backend and obfuscation tools, allowing attackers to create new malware variants on demand. The infrastructure includes static files and a FastAPI-based builder, which can generate polymorphic banking malware. The discovery was made via Shodan, highlighting the vulnerabilities in the RAT's operational security. Researchers are now able to analyze the obfuscation techniques used in the malware. The active exploitation of this infrastructure poses a significant threat to financial institutions and their customers. Current assessments indicate that the malware can evade detection by security systems, increasing the risk of successful attacks. The situation remains critical as the server is still active and being utilized for malicious purposes. 2 sources 64

Extracted Entities

Exposed Banana RAT Infrastructure Reveals Payload Generator and Obfuscator Tooling

The full story

Extracted Entities

Attack Types (1)

IP Addresses (1)

Malware (1)

Tools (2)