JanelaRAT Malware Targets Latin American Banks with 14,739 Attacks in Brazil in 2025

JanelaRAT is an actively deployed remote access trojan targeting banks and financial institutions across Latin America (notably Brazil, Mexico, Chile, and Colombia). Operators deliver the malware via phishing links to ZIP archives or rogue MSI installers that use DLL side-loading and orchestrating scripts to install a RAT, browser extensions, and supporting components; once installed it establishes C2 communications, persists via Startup LNKs, and performs credential theft, screenshots, input injection, fake overlays, keystroke capture, and anti-analysis checks to intercept financial interactions.