Malware
Banana RAT
- First Reported
- May 19, 2026
- Latest Reported
- Aug 4, 2026
Reported Context (4)
- A single endpoint could expose access across the business: DestinyStealer, Banana RAT, DARTHVADER Stealer, and OVERLORD RAT collected or targeted browser credentials, cookies, Outlook data, VPN access, file-transfer July 2026 Attacks Targeted US, European and Brazilian Organizations with Phishing and Malware
- What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to the same infrastructure. Banana RAT Branches Show New Persistence and WebSocket C2 Techniques
- Update: Prior to our publication, Trend Micro wrote a blog post on this malware family that they dubbed Banana RAT with a different attack path. AI-Generated Bank Lure Uses ClickFix to Deliver SmartRAT
- Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud Researchers Map Banana RAT’s End-to-End Operation Targeting Brazilian Banks
Malware (13)
People (5)
Threat Actors (1)
MITRE ATT&CK (24)
Vendors (5)
Products (13)
Tools (4)
Industries (10)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.