Banana RAT Intercepts PIX QR Payment Data

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•4

Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.