Hackers Weaponize NF

Gbhackers •Mayura Kathir • May 22, 2026

Hackers are actively using Brazil’s electronic invoice system (NF-e) as a lure to distribute a sophisticated banking trojan known as Banana RAT. The campaign has been attributed to a financially motivated threat cluster tracked as SHADOW-WATER-063 and appears exclusively focused on Brazilian financial institutions. The investigation is notable because analysts obtained visibility into both attacker […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Banking Trojan Banana RAT Exploits Brazil's NF-e System Hackers are leveraging Brazil's electronic invoice system (NF-e) to distribute the Banana RAT banking trojan, specifically targeting Brazilian financial institutions. This campaign, attributed to the financially motivated threat cluster SHADOW-WATER-063, uses fake NF-e documents to deceive victims into executing malicious batch files. Once activated, the trojan installs a remote access tool on Windows systems, allowing attackers to gain unauthorized access. The operation has raised alarms due to its sophistication and focus on financial theft. Analysts have gained insights into the attack methods, but the full scope of the campaign's impact remains under investigation. As of now, the campaign is ongoing, and users are advised to remain vigilant. 2 sources 67

Extracted Entities

Hackers Weaponize NF

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

Malware (1)

Platforms (1)