In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks

TrendAI's investigation exposes "Banana RAT," a sophisticated, polymorphic banking trojan used by SHADOW-WATER-063 to execute operator-driven financial fraud against Brazilian institutions and customers. The malware uses server-side dynamic builders, fileless AES-wrapped payloads loaded via PowerShell into memory, live human-operated session hijacking (remote input, screen streaming, keylogging), and targeted Pix-QR interception to siphon funds; developers are reportedly commercializing the toolkit as MaaS, increasing scale and risk.