Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

Janela RAT

Janela RAT is a remote access trojan used in an active malware campaign targeting financial institutions, fintech firms, and cryptocurrency platforms across Latin America, particularly in Chile, Colombia, and Mexico. First identified in mid-2023, it is assessed to be a modified variant of BX RAT and is associated with financially motivated operators seeking to steal credentials and gain unauthorized access to accounts.

The infection chain begins when a victim executes a malicious MSI installer disguised as legitimate software and hosted on public GitLab repositories. The installer launches a multi-stage sequence involving Go, PowerShell, and batch scripts. A Go-based unpacker extracts a password-protected ZIP archive, decodes base64-encoded command-and-control domain details, and writes the decoded C2 information into a config.json file. The malware then scans the host for Chromium-based browsers and modifies browser startup settings to silently load a malicious extension.

The browser extension registers as a native messaging host and uses a built-in function called CollectRefresh to gather system details, browser cookies, saved credentials, browsing history, installed extensions, and open tab information. It monitors for specific URL patterns, including banking and cryptocurrency login pages, and can trigger additional RAT actions when those patterns are matched. This enables theft of browser data that can support account takeover, bypass authentication steps, and monitor financial activity and live transactions.

Janela RAT communicates with attacker-controlled infrastructure over encrypted WebSocket connections and uses obfuscated, base64-encoded domains for C2. It also rotates C2 addresses dynamically and remains quiet during idle periods to reduce behavioral detection. KPMG analysts described the campaign as an advanced multi-stage threat and assessed it as a significant risk to Latin America’s financial infrastructure.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence1

This report focuses on the URLs embedded in emails that bypassed email security controls like secure email gateways (SEGs) to deliver malware.

T1566.002Spearphishing LinkEvidence1

Infection URLs are embedded in emails and represent the first action that a victim must take to become infected.

Execution

3 techniques
T1059.001PowerShellEvidence1

Once executed, the installer quietly triggers a chain of scripts written in Go, PowerShell, and batch, each playing a specific role in setting up the full attack.

T1059.003Windows Command ShellEvidence1

Once executed, the installer quietly triggers a chain of scripts written in Go, PowerShell, and batch, each playing a specific role in setting up the full attack.

T1204.002Malicious FileEvidence1

The infection begins the moment a user runs what appears to be a regular software installer in MSI format. These installer files are hosted on public GitLab repositories and are carefully disguised to appear trustworthy and legitimate.

Persistence

2 techniques
T1112Modify RegistryEvidence1

At the same time, the scripts scan the infected machine for any Chromium-based browsers and quietly modify their startup settings to silently load a malicious extension without the user’s knowledge.

T1176Software ExtensionsEvidence1

At the same time, the scripts scan the infected machine for any Chromium-based browsers and quietly modify their startup settings to silently load a malicious extension without the user’s knowledge.

Stealth

2 techniques
T1027Obfuscated Files or InformationEvidence1

A Go-based unpacker then extracts a password-protected ZIP file, decodes base64-encoded command-and-control domain details, and writes all of it into a config.json file for operational use during the campaign.

T1036MasqueradingEvidence1

Researchers highlighted how Janela RAT disguises itself as trusted software on public GitLab repositories, making it harder for users to spot the danger before damage is done.

Defense Impairment

1 technique
T1112Modify RegistryEvidence1

At the same time, the scripts scan the infected machine for any Chromium-based browsers and quietly modify their startup settings to silently load a malicious extension without the user’s knowledge.

Credential Access

2 techniques
T1539Steal Web Session CookieEvidence1

By accessing browsers and harvesting cookies, saved credentials, and browsing history, the attackers gain complete visibility into a victim’s financial activity.

T1555Credentials from Password StoresEvidence1

By accessing browsers and harvesting cookies, saved credentials, and browsing history, the attackers gain complete visibility into a victim’s financial activity.

Collection

2 techniques
T1185Browser Session HijackingEvidence1

This extension registers itself as a native messaging host and uses a built-in function called CollectRefresh to collect a wide range of sensitive data — including system details, browser cookies, browsing history, installed extensions, and open tab information.

T1560Archive Collected DataEvidence1

A Go-based unpacker then extracts a password-protected ZIP file, decodes base64-encoded command-and-control domain details, and writes all of it into a config.json file for operational use during the campaign.

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence1

To avoid detection, Janela RAT establishes encrypted WebSocket connections to its C2 servers using obfuscated, base64-encoded domains.

T1568Dynamic ResolutionEvidence1

The malware also rotates its C2 addresses dynamically and stays quiet during idle periods to avoid triggering behavior-based security alarms.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Janela RAT | Mallory