Executive Summary
JanelaRAT is a modified variant of the BX RAT malware specifically engineered to target financial institutions and cryptocurrency users in Latin America, primarily in Brazil and Mexico. Since June 2023, the threat actors have continuously refined their infection chain, transitioning from simple VBScript and ZIP archives to sophisticated MSI installers and DLL side-loading techniques to evade detection.
The malware's technical sophistication is highlighted by its custom title-bar detection mechanism, which identifies when a victim is visiting a banking website to trigger real-time malicious actions. It features an interactive C2 channel, live banking session hijacking, and a robust decoy overlay system that mimics legitimate banking or system interfaces (including fake Windows updates) to harvest credentials and multi-factor authentication tokens.
The impact is significant, with over 26,000 attacks detected in 2025 across Brazil and Mexico. The malware includes anti-analysis routines, detects banking security software, and employs dynamic DNS rotation to maintain persistence and bypass traditional perimeter defenses.