Banana RAT Exploits Fake NF-e Invoice Documents using Phishing

EXECUTIVE SUMMARY:

A newly identified banking-focused remote access trojan, Banana RAT, has been observed in active campaigns attributed to the threat activity cluster SHADOW-WATER-063, targeting financial users through deceptive social engineering techniques. The malware is designed to impersonate legitimate documents and system notifications in order to trick victims into executing malicious files. Once deployed, it enables attackers to gain full control over infected systems, allowing them to monitor user activity and manipulate financial transactions in real time. The operation is primarily financially motivated and is structured to maximize stealth and fraud efficiency.[emaillocker id="1283"]

The malware operates through a multi-stage infection chain initiated by a disguised batch file delivered via phishing messages or fake document lures. Upon execution, a PowerShell-based loader retrieves an encrypted payload from a remote server and executes it entirely in memory, minimizing forensic traces on disk. The payload is heavily obfuscated using multiple encryption and packing layers, enabling it to evade signature-based detection. It establishes persistence through scheduled tasks and communicates with command-and-control infrastructure over encrypted channels. Once active, the trojan provides full remote access capabilities including live screen streaming, keyboard and mouse control, keylogging, clipboard manipulation, and browser session monitoring. It is also capable of detecting active banking sessions and deploying full-screen overlay attacks to impersonate financial institutions, while intercepting payment mechanisms such as QR-based transactions to redirect funds to attacker-controlled accounts.

Banana RAT represents a highly adaptive banking trojan that combines fileless execution, polymorphism, and remote access capabilities to conduct financial theft at scale. Its ability to maintain stealth while enabling full system compromise makes it a significant threat to banking users, particularly in environments where phishing resistance and endpoint monitoring are limited. Organizations and users are advised to strengthen phishing awareness, enforce endpoint detection mechanisms, and monitor for anomalous banking activity to mitigate such threats.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

https://cybersecuritynews.com/hackers-use-nf-e-invoice-lures/
https://www.trendmicro.com/en_us/research/26/e/banana-rat.html