Banking Trojan Banana RAT Exploits Brazil's NF-e System

• •The Banana RAT trojan is disguised as legitimate NF-e documents to trick users.
• •The attack primarily targets Brazilian financial institutions, indicating a focused campaign.
• •Victims are deceived into executing malicious files that install remote access tools.

Hackers are leveraging Brazil's electronic invoice system (NF-e) to distribute the Banana RAT banking trojan, specifically targeting Brazilian financial institutions. This campaign, attributed to the financially motivated threat cluster SHADOW-WATER-063, uses fake NF-e documents to deceive victims into executing malicious batch files. Once activated, the trojan installs a remote access tool on Windows systems, allowing attackers to gain unauthorized access. The operation has raised alarms due to its sophistication and focus on financial theft. Analysts have gained insights into the attack methods, but the full scope of the campaign's impact remains under investigation. As of now, the campaign is ongoing, and users are advised to remain vigilant.