An MDR investigation successfully mapped the complete operational infrastructure of Banana RAT, a Brazilian banking trojan operated by threat cluster SHADOW-WATER-063. The investigation uncovered both server-side and client-side components, revealing a sophisticated FastAPI-based polymorphic payload generation system that produces hash-unique builds to evade detection. The malware employs layered obfuscation, AES-wrapped payloads, and fileless PowerShell execution. Once deployed, it enables operator-driven fraud through remote input control, keylogging, screen streaming, bank-branded overlays, and Pix QR code interception specifically targeting Brazilian financial institutions. The tooling exclusively targets 16 Brazilian banks and crypto exchanges, with all operator artifacts written in Brazilian Portuguese, indicating a financially motivated actor operating within the Tetrade banking trojan ecosystem.
Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...
Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...
A Brazilian anti-DDoS technology firm was found to have enabled a botnet that launched prolonged and massive distributed denial-of-service (DDoS) attacks against other Brazilian network operators. The firm's CEO attributes the malicious activity to a security breach, suggesting it was likely orchestrated by a competitor aiming to damage the company's reputation. There is no evidence of known exploits in the wild beyond this incident, and no patch or remediation information is available. The incident highlights risks related to insider threats or compromised infrastructure within security service providers.
ESET researchers have identified a new NGate malware variant targeting Android users in Brazil since November 2025. The threat actors trojanized the legitimate HandyPay NFC payment application, likely using AI-generated code, to relay NFC data from victims' payment cards to attacker-controlled devices. The malware enables unauthorized ATM withdrawals and payments while also capturing and exfiltrating payment card PINs to command-and-control servers. Distribution occurs through two channels: a fake Rio de Prêmios lottery website where victims always win a rigged prize, and a fraudulent Google Play page offering a fake card protection app. Both distribution sites are hosted on the same domain. This campaign represents an evolution in NFC-based fraud, with attackers choosing to patch existing legitimate applications rather than using established malware-as-a-service offerings.
A Brazilian banking fraud operation leveraging ClickFix social engineering was discovered through a community tip, exposing a completely unauthenticated command-and-control infrastructure. The campaign deploys a malicious Chrome extension masquerading as a Banco Central do Brasil tool, force-installed via Chrome Cloud Management enrollment tokens. The extension achieves zero antivirus detections while targeting eight Brazilian financial institutions. At investigation time, 59 machines were compromised with seven active connections. The operator's C2 server exposed all endpoints without authentication, including admin panels, live victim screenshots, stolen credentials in cleartext, and intercepted Pix payment data. Attribution was established through WHOIS records revealing the operator's real name, CPF, and email address. The operation specifically targeted Northern Brazilian regional banks and credit cooperatives, with evidence of compromising a school fund account.
A BTS comeback and world-tour announcement has resulted in a new wave of scam campaigns. Kaspersky experts have discovered fraudulent websites that sell fake BTS tickets to fans all around the world. We explain what those fake pages look like, and how you can avoid getting scammed.
The CrystalX Remote Access Trojan (RAT) is a newly identified malware capable of spying on victims, stealing sensitive information, and modifying device configurations. Although it is described as sophisticated, there are currently no known exploits in the wild and no specific affected software versions have been identified. The malware's capabilities suggest it targets confidentiality and integrity by enabling unauthorized surveillance and data theft. The threat is assessed as medium severity due to the lack of widespread exploitation and limited technical details. Organizations should monitor for unusual device behavior and implement strong endpoint detection measures. Countries with significant use of Windows-based systems and high-value targets in sectors like finance, government, and critical infrastructure are most at risk. Proactive threat hunting and network segmentation can help mitigate potential impacts. Immediate patching recommendations are unavailable, so focus should be on detection and containment strategies.
Today, most malware are called “fileless” because they try to reduce their footprint on the infected computer filesystem to the bare minimum. But they need to write something… think about persistence. They can use the registry as an alternative storage location.
Active since September 2025, Yurei is a double extortion ransomware campaign. The operators run their own Tor data leak site with a low number of victims listed at the time of writing. It is reportedly derived from Prince Ransomware, an open-source ransomware family written in Go. Check Point researchers noted that all samples were first submitted to VirusTotal from Morocco, and that one sample did not include a ticket ID, indicating that this could be a test build, possibly uploaded by the developer themselves. Yurei ransomware samples also contained a link to SatanLockv2, based on the presence of the PDB path string “D:\satanlockv2” present in the Yurei samples.
Hasbro, a major toy manufacturer, has been targeted by a cyberattack currently under investigation. The company is assessing the full extent of the incident, including whether any sensitive files or data have been compromised. No specific technical details, attack vectors, or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild related to this incident at this time. The severity is currently assessed as medium based on limited information. Organizations should monitor for updates and review their security posture, especially those in the toy and manufacturing sectors. The attack highlights the ongoing risk of cyber threats to large consumer goods companies. Immediate containment and forensic analysis are critical to understand the breach scope. This incident may have implications for supply chain security and customer data protection. Defenders should prioritize incident response readiness and data protection strategies.
The new CrystalX remote access Trojan combines pranks with full control over the victim’s computer. It also spies on its victims, steals their cryptocurrency and accounts, and uses advanced methods to bypass protection. We explain how it works, and how to avoid infection.
DeepLoad is a newly identified malware involved in ClickFix attacks that primarily steals user credentials, installs malicious browser extensions, and propagates through USB drives. It leverages social engineering or phishing to infect systems, then harvests sensitive information and potentially facilitates further compromise via browser manipulation. The malware’s ability to spread via removable media increases its risk of lateral movement within organizations. Although no known exploits are currently reported in the wild, the malware’s credential theft and persistence mechanisms pose a significant threat to confidentiality and integrity. Exploitation does not appear to require advanced privileges or complex exploits, but likely involves user interaction such as opening malicious attachments or USB devices. Organizations with high reliance on browser-based workflows and removable media are particularly vulnerable. Mitigation requires targeted controls including endpoint detection, strict USB device policies, and monitoring for unusual browser extension installations. Countries with large enterprise sectors and high internet usage, especially in North America, Europe, and parts of Asia, are most at risk. Given the malware’s impact on credential security and propagation ease, the threat severity is assessed as high.
BlueVoyant researchers have uncovered a broad, multi-pronged phishing campaign targeting Spanish-speaking users in organizations across Latin America and now Europe as well. While recent industry intelligence heavily documented attacks utilizing WhatsApp to deliver banking trojans under the umbrella of the Brazil-based eCrime group Augmented Marauder (a.k.a. Water Saci)
Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions that delivered a cross-platform Remote Access Trojan to macOS, Windows, and Linux systems through a malicious postinstall hook.
Xloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands and download second-stage payloads on an infected system. The author of Xloader continues to update the codebase, with the most recent observed version being 8.7. Since version 8.1, the Xloader developer applied several changes to the code obfuscation. The purpose of this blog is to describe the latest obfuscation methods and provide an in-depth analysis of the network communication protocol. We highly recommend reading our previous blogs about Xloader in order to get a better understanding of the malware’s internals.
This multi-stage fileless Remcos RAT attack leverages a phishing-delivered JavaScript dropper to trigger a reflective PowerShell loader that executes payloads entirely in memory. The infection chain utilizes obfuscation techniques like rotational XOR and Base64 encoding to reconstruct .NET payloads, significantly reducing the disk-based detection footprint. Stealth is maintained by using aspnet_compiler.exe as a LOLBin to proxy malicious execution and dynamically retrieving the final payload from a remote C2 server.
In March 2026, a new MaaS active campaign was discovered promoting previously unknown malware in private Telegram chats. The Trojan features an extensive arsenal of capabilities. On the panel provided to third‑party actors, in addition to the standard features of RAT‑like malware, a stealer, keylogger, clipper, and spyware are also available.
