New Janela Campaign Deploys Deceptive MSI Files, Malicious Extensions For Stealthy Theft

**Executive summary:** A financially motivated campaign using Janela RAT has been observed targeting banking, fintech and cryptocurrency users in Chile, Colombia and Mexico via malicious MSI installers hosted on GitLab and a malicious Chromium extension that establishes native messaging for credential and data theft; the report details the multi-stage unpacking, password-protected ZIP handling, base64-encoded rotating C2 domains, persistence techniques, and provides domains, IPs and sample file hashes with attribution to a KPMG alert.