ThreatCluster

Banking Trojan Banana RAT Exploits Brazil's NF-e System

First seen 22 May 2026, 21:11 UTC • •67

Article Content

1 / 3

Browse articles

ThreatCluster •May 23, 2026 at 20:03 UTC

•The Banana RAT trojan is disguised as legitimate NF-e documents to trick users.
•The attack primarily targets Brazilian financial institutions, indicating a focused campaign.
•Victims are deceived into executing malicious files that install remote access tools.

Hackers are leveraging Brazil's electronic invoice system (NF-e) to distribute the Banana RAT banking trojan, specifically targeting Brazilian financial institutions. This campaign, attributed to the financially motivated threat cluster SHADOW-WATER-063, uses fake NF-e documents to deceive victims into executing malicious batch files. Once activated, the trojan installs a remote access tool on Windows systems, allowing attackers to gain unauthorized access. The operation has raised alarms due to its sophistication and focus on financial theft. Analysts have gained insights into the attack methods, but the full scope of the campaign's impact remains under investigation. As of now, the campaign is ongoing, and users are advised to remain vigilant.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 110d ago How this analysis works

Timeline

2026-05-22

Banana RAT campaign identified

Hackers are using Brazil's NF-e system to distribute the Banana RAT banking trojan targeting financial institutions.

2026-05-22

Malware installation method detailed

The trojan tricks users into running malicious batch files disguised as NF-e documents, leading to remote access tool installation.

Cybersecuritynews

More articles in this cluster (2)

Threat Graph

7 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Trojan
T1059.003 - Windows Command Shell

Campaign (1)

Shadow-water-063

Malware (1)

Banana RAT

Affected Platform (2)

NF-e
Windows

Relationships

Shadow-water-063 uses Banana RAT
Malware targets NF-e
Malware targets Windows
Trojan targets NF-e
Trojan targets Windows
T1059.003 - Windows Command Shell targets NF-e
T1059.003 - Windows Command Shell targets Windows

Following this threat?

Track Banana RAT in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by…