Janela RAT Spreads via Fake MSI Installers, Malicious Extensions

Gbhackers •Mayura Kathir • April 14, 2026

Janela Remote Access Trojan (RAT) campaign using fake Windows MSI installers and malicious browser extensions to infiltrate financial networks and exfiltrate sensitive data. The latest Janela RAT samples are being distributed through public GitLab repositories, where attackers host MSI installation files disguised as legitimate software installers. Unsuspecting users in Chile, Colombia, and Mexico the campaign’s primary targets are lured into downloading these […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JanelaRAT Malware Campaign Targets Latin American Financial Sector JanelaRAT, a Remote Access Trojan, is actively targeting financial institutions and cryptocurrency platforms in Latin America. The malware, which has been in circulation since June 2023, employs fake MSI installer files and malicious browser extensions to steal sensitive financial data. Victims are lured through phishing emails that mimic invoice deliveries, leading them to download malicious files. The infection chain has evolved to include the use of MSI files as droppers for the final payload, which is a DLL associated with JanelaRAT. Kaspersky detects this threat as Trojan.Script.Generic and Backdoor.MSIL.Agent.gen. The continuous updates to the malware's infection chain indicate that threat actors are adapting their tactics to evade detection. Current campaigns show a streamlined process with fewer installation steps, enhancing the malware's effectiveness. The scope of impact is significant, affecting numerous users across the region. 3 sources 70

Extracted Entities

Janela RAT Spreads via Fake MSI Installers, Malicious Extensions

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Countries (3)

Industries (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (2)