Hackers Use NF

Cybersecuritynews •Tushar Subhra Dutta • May 22, 2026

A newly discovered banking trojan is targeting Brazilians by disguising itself as a legitimate electronic invoice. The malware, known as Banana RAT, uses fake NF-e (Nota Fiscal Eletronica) documents to trick victims into running malicious batch files that quietly install a powerful remote access tool on their Windows systems. The campaign has been active and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Banking Trojan Banana RAT Exploits Brazil's NF-e System Hackers are leveraging Brazil's electronic invoice system (NF-e) to distribute the Banana RAT banking trojan, specifically targeting Brazilian financial institutions. This campaign, attributed to the financially motivated threat cluster SHADOW-WATER-063, uses fake NF-e documents to deceive victims into executing malicious batch files. Once activated, the trojan installs a remote access tool on Windows systems, allowing attackers to gain unauthorized access. The operation has raised alarms due to its sophistication and focus on financial theft. Analysts have gained insights into the attack methods, but the full scope of the campaign's impact remains under investigation. As of now, the campaign is ongoing, and users are advised to remain vigilant. 2 sources 67

Extracted Entities

Hackers Use NF

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)