Banatrix successor – swapping acct numbers with a Firefox add-on

**Executive Summary:** This report analyzes a Polish-targeted banking malware campaign (attributed to Banatrix authors) that infects users via trojanized installers, uses a dropper to place wget and create a scheduled task to fetch a payload, and installs a Firefox add-on which intercepts banking traffic to replace recipient account numbers with mule accounts and capture transaction screenshots; the document includes technical details, mitigation advice (update Firefox), and SHA256 hashes for identified samples.