New Janela RAT Campaign Uses Fake MSI Installers and Malicious Browser Extensions to Steal Data

Cybersecuritynews •Tushar Subhra Dutta • April 14, 2026

A new malware campaign involving a Remote Access Trojan called Janela RAT has been actively targeting financial institutions and cryptocurrency platforms across Latin America. The threat actors behind this attack are using fake MSI installer files and malicious browser extensions to infiltrate systems and steal sensitive financial data from unsuspecting victims. Janela RAT was first […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

JanelaRAT Malware Campaign Targets Latin American Financial Sector JanelaRAT, a Remote Access Trojan, is actively targeting financial institutions and cryptocurrency platforms in Latin America. The malware, which has been in circulation since June 2023, employs fake MSI installer files and malicious browser extensions to steal sensitive financial data. Victims are lured through phishing emails that mimic invoice deliveries, leading them to download malicious files. The infection chain has evolved to include the use of MSI files as droppers for the final payload, which is a DLL associated with JanelaRAT. Kaspersky detects this threat as Trojan.Script.Generic and Backdoor.MSIL.Agent.gen. The continuous updates to the malware's infection chain indicate that threat actors are adapting their tactics to evade detection. Current campaigns show a streamlined process with fewer installation steps, enhancing the malware's effectiveness. The scope of impact is significant, affecting numerous users across the region. 3 sources 70

Extracted Entities

New Janela RAT Campaign Uses Fake MSI Installers and Malicious Browser Extensions to Steal Data

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

Malware (1)