JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts

JanelaRAT is a sophisticated banking-focused Remote Access Trojan active in Latin America that uses deceptive invoice emails, malicious downloads (ZIP/MSI), DLL sideloading, and a custom title-bar detection to monitor and hijack live banking sessions; it employs inactivity tracking and full-screen decoy overlays to capture credentials and bypass MFA, with Kaspersky telemetry reporting 14,739 attacks in Brazil and 11,695 in Mexico in 2025.