Hackers Weaponize NF-e Invoice Lures to Deploy Banana RAT

Hackers are actively using Brazil’s electronic invoice system (NF-e) as a lure to distribute a sophisticated banking trojan known as Banana RAT.

The campaign has been attributed to a financially motivated threat cluster tracked as SHADOW-WATER-063 and appears exclusively focused on Brazilian financial institutions.

The investigation is notable because analysts obtained visibility into both attacker infrastructure and victim endpoints, allowing them to reconstruct the entire attack lifecycle.

By correlating server-side tooling with endpoint telemetry, researchers mapped the full operational chain from payload generation to execution and command-and-control (C2) communication.

The attack begins with social engineering. Victims are lured via WhatsApp messages or phishing links into downloading a malicious batch file named “Consultar_NF-e.bat,” hosted on domains such as convitemundial2026[.]com. The file impersonates a legitimate NF-e invoice, a widely used electronic billing format in Brazil.

Once executed, the batch file launches an obfuscated PowerShell command that retrieves a second-stage payload (msedge.txt) from attacker-controlled infrastructure.

This payload is never written to disk in decrypted form; instead, it executes directly in memory using PowerShell’s ScriptBlock mechanism.

TrendAI™ said in a report shared with GBhackers, attacker infrastructure and endpoint telemetry to map the full operational model of Banana RAT, a banking trojan attributed to a threat activity cluster that tracks as SHADOW-WATER-063.

Hackers Weaponize NF-e Invoice

On the backend, attackers operate a FastAPI-based payload generation system. A clean PowerShell banking trojan serves as the source, which is then wrapped with multiple obfuscation layers and AES-256-CBC encryption. The system maintains a pool of 100 to 200 pre-generated payloads, each unique per victim request.

This polymorphic approach ensures that every delivered sample differs at the byte level, effectively bypassing hash-based detection. Each payload is served once via payload.php, limiting reuse and complicating analysis.

Once deployed, Banana RAT functions as a full-featured remote access trojan tailored for financial fraud. Key capabilities include:

• Real-time screen streaming and remote input control.
• Keylogging and clipboard manipulation.
• Banking-specific overlay injection targeting institutions like Itaú, Bradesco, and Santander.
• Pix QR code interception, enabling attackers to manipulate Brazil’s instant payment system.
• File exfiltration and process monitoring.

The malware also uses AES-encrypted communications over TCP port 443 and authenticates sessions using HMAC-SHA256 tokens derived from system identifiers.

Every served payload differs in variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and AES-encrypted code blobs, making file-hash detection essentially impossible at population scale.

To evade detection, the malware leverages layered obfuscation, fileless execution, and deceptive file paths such as C:\ProgramData\Microsoft\Diagnosis\ETW. Persistence is established through hidden scheduled tasks configured to run every minute for extended periods, executing PowerShell with bypassed security policies.

Additionally, the malware dynamically compiles C# components using csc.exe, enabling modular functionality such as input control, screen capture, and overlay rendering.

The C2 infrastructure includes domains like windowsk-cdn[.]com and IP addresses such as 24.199.90[.]58. The server environment hosts PHP payload delivery scripts, Python orchestration tools, and an analytics dashboard that tracks victim metrics in real time.

Attribution analysis points to Brazilian Portuguese-speaking operators, supported by language artifacts, exclusive targeting of Brazilian banks, and the inclusion of Pix-specific fraud modules.

The GrabEznn method specifically takes the width and height, then copies that portion of the screen starting from the top-left corner into a Bitmap object using the BitBlt function.

The campaign also shows tradecraft similarities with the “Tetrade” banking malware ecosystem, including families like Grandoreiro and Mekotio, though architectural differences suggest it may be a parallel or evolving operation.

Banana RAT is designed solely for fraud execution. Its features enable attackers to take over banking sessions, manipulate transactions, and deceive users with convincing overlays that mimic system updates or bank interfaces.

TrendAI is coordinating with FEBRABAN (the Brazilian Federation of Banks) to share intelligence and mitigate risks. Defenders are advised to block known delivery domains, monitor PowerShell activity, and detect unusual outbound connections to suspicious C2 infrastructure.

This campaign highlights the growing sophistication of banking trojans in Latin America, particularly the shift toward malware-as-a-service models and highly targeted financial attacks.

Indicators of Compromise (IOCs)

SHA256	File	Detection name
ecdc8fade561a75d68235859ad8b1fe131db2c458b4894268e38e90ecab1c47f	st.txt	Backdoor.PS1.BANANARAT.A
38dfeb772afbd01c04eddda120d283acfb1147a6dc3d54ac62fe23ad06e39d8f	st.php	Trojan.PS1.BANANARAT.A
4912b1134e69ade7266e8508eec33ccb2d80ad693f1dbc4f1f4344c6dfcf2ff1	payload.php	Trojan.PS1.BANANARAT.A
d7545b6dacebdae27effb3c778c5e349027ec789c76ae4f777bd9ba56a70cdaa	msedge.txt	Backdoor.PS1.BANANARAT.A

IP/Domain	Detection
hxxp[://]24[.]199[.]90[.]58:80/	Disease vector
hxxp[://]24[.]199[.]90[.]58:80/payload[.]php	Disease vector
hxxp[://]24[.]199[.]90[.]58:80/st[.]txt	Disease vector
c[.]windowsk-cdn[.]com	C&C server
162.141.111[.]227:443	C&C server

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.