Kaspersky Reports 14,739 JanelaRAT Attacks Recorded in Brazil in 2025
Summary
Kaspersky says JanelaRAT targets Latin American financial institutions using phishing, DLL side-loading and a malicious Chromium extension. Telemetry recorded 14,739 attacks in Brazil and 11,695 in Mexico in 2025; successful compromises are unknown.
Key points
- Kaspersky telemetry recorded 14,739 JanelaRAT attacks in Brazil and 11,695 in Mexico in 2025; the number of successful compromises is unknown.
- The malware targets financial institutions in Latin America, including Brazil, Mexico, Chile and Colombia, to steal financial or cryptocurrency data.
- Reported infection methods include phishing links leading to ZIP archives and, since at least May 2024, rogue MSI installers that use DLL side-loading and create a Startup-folder shortcut.
- A malicious Chromium extension can collect cookies, browsing history, installed extensions and tab metadata, and trigger actions on URL matches.
- JanelaRAT compares active window titles with a hard-coded list of financial institutions and opens a dedicated C2 channel after a match.
- Its reported capabilities include screenshots, keystroke capture, input simulation, fake overlays for credential theft, system metadata collection and detection of anti-fraud or analysis tools.
- The malware tracks user activity and reports periods of inactivity to its C2 server, which Kaspersky says can help actors time remote operations.
Article Details
- Attack Vectors
- Phishing emails disguised as outstanding invoices link recipients to a PDF download that leads to a ZIP archive and the JanelaRAT infection chain.
- Earlier campaigns used ZIP archives containing VBScript to download another ZIP archive with a legitimate executable and a DLL payload; the DLL was side-loaded to launch JanelaRAT.
- Rogue MSI installers, reportedly hosted on trusted platforms such as GitLab, use scripts and DLL side-loading to install the malware and create a Startup-folder shortcut for persistence.
- The malware modifies Chromium-based browser launch parameters to load a malicious extension that collects browser data and responds to URL-pattern matches.
MITRE ATT&CK
T1056.001 · KeyloggingJanelaRAT captures victims' keystrokes.T1059.001 · PowerShellThe MSI-based infection chain uses PowerShell scripts to unpack and install components.T1059.003 · Windows Command ShellThe MSI-based infection chain also uses batch scripts, and JanelaRAT can run commands using cmd.exe.T1059.005 · Visual BasicEarlier infection chains used VBScript in ZIP archives to download a second ZIP archive.T1095 · Non-Application Layer ProtocolJanelaRAT communicates with its C2 server through a TCP socket.T1113 · Screen CaptureJanelaRAT captures screenshots and can crop screen regions for exfiltration.T1176 · Software ExtensionsThe infection process installs a malicious Chromium-based browser extension by modifying browser launch parameters.T1217 · Browser Information DiscoveryThe malicious browser extension collects browsing history, installed-extension information, and tab metadata.T1497.001 · System ChecksThe malware detects sandbox and automation tools as part of its anti-analysis behavior.T1539 · Steal Web Session CookieThe malicious browser extension collects cookies from victims' browsers.T1547.009 · Shortcut ModificationThe malware establishes persistence by creating a Windows Shortcut in the Startup folder that points to its executable.T1566.002 · Spearphishing LinkPhishing emails disguised as outstanding invoices link recipients to a PDF download that leads to the infection chain.T1574.002 · DLL Side-LoadingThe infection chain uses DLL side-loading to launch JanelaRAT.
Malware
BX RATJanelaRAT, a modified BX RAT, is actively targeting banks and financial institutions in Latin America—particularly Brazil and Mexico—to steal financial and cryptocurrency data while monitoring user activity andJanelaRATJanelaRAT, a modified BX RAT, is actively targeting banks and financial institutions in Latin America—particularly Brazil and Mexico—to steal financial and cryptocurrency data while monitoring user activity and
Vendors
Kasperskydetection mechanism to identify desired websites in victims’ browsers and perform malicious actions,” Kaspersky said in a report published today.ZscalerFirst detected in the wild by Zscaler in June 2023, JanelaRAT has leveraged ZIP archives containing a Visual Basic Script (VBScript) to download a second ZIP file, which, in turn, comes with a legitimate executable and
Products
Chromiuminfection chain leverages ZIP/VBScript and rogue MSI installers with DLL side-loading, plus malicious Chromium extensions and C2 controls to capture screenshots, keystrokes, and deploy interactive overlays toMicrosoft Windowsas a dropper for the malware using DLL side-loading and establish persistence on the host by creating a Windows Shortcut (LNK) in the Startup folder that points to the executable.
Countries
Brazila modified BX RAT, is actively targeting banks and financial institutions in Latin America—particularly Brazil and Mexico—to steal financial and cryptocurrency data while monitoring user activity and manipulatingChileJanelaRAT primarily targets banks and financial institutions in Brazil, Mexico, Chile, and Colombia.ColombiaJanelaRAT primarily targets banks and financial institutions in Brazil, Mexico, Chile, and Colombia.MexicoBX RAT, is actively targeting banks and financial institutions in Latin America—particularly Brazil and Mexico—to steal financial and cryptocurrency data while monitoring user activity and manipulating browsers.