Hackers Use NF-e Invoice Lures to Deliver Banana RAT Through Malicious Batch Files

Banana RAT is a targeted and sophisticated banking RAT campaign that uses fake NF-e invoice .bat lures to install an AES-256 encrypted, in-memory payload that achieves persistence via hidden scheduled tasks. The malware—tracked as SHADOW-WATER-063/Projeto Banana—targets 16 major Brazilian banks and local crypto exchanges, provides screen streaming, keylogging, banking overlay injection, and Pix QR code interception, and uses polymorphic builds, typosquatted CDN domains, and hardened C2 infrastructure; the report includes multiple IoCs and mitigation recommendations.