A Sophisticated Threat Emerges from the Shadows

Financial institutions across Latin America are facing a renewed and cunning cyber threat. A campaign deploying the Janela Remote Access Trojan (RAT) has been meticulously crafted to steal sensitive data from users in the banking, fintech, and cryptocurrency sectors. First observed in mid-2023, this malware represents a modified evolution of the older BX RAT, showcasing significant advancements in stealth and persistence. Its primary targets are concentrated in Chile, Colombia, and Mexico, where financially motivated actors seek the highest possible return on their malicious investment.

The Bait and Switch of Fake Installers

The attack chain begins with a classic yet effective deception. Threat actors are hosting malicious MSI installer files on public GitLab repositories, cleverly disguising them as legitimate software from trusted platforms. Imagine downloading what you believe is a necessary update or a useful utility, only to unleash a digital parasite. Once an unsuspecting user executes this installer, it triggers a complex, multi-stage infection process designed to fly under the radar.

This process is orchestrated by a series of scripts written in Go, PowerShell, and batch files. Their first job is to unpack a concealed ZIP archive. This archive is the treasure trove for the attackers, containing the core RAT executable, a malicious Chromium-based browser extension, and various helper tools. It is a complete toolkit for digital theft.

Unpacking a Multi-Layered Infection Chain

Separate scripts work in tandem to establish the malware’s foothold. One, often a batch or PowerShell script, is responsible for crafting the commands to launch the RAT executable with a predetermined, fixed filename. Meanwhile, a more sophisticated Go-based unpacker goes to work on a password-protected ZIP file. This unpacker decodes base64-encoded command-and-control (C2) domains and repository lists, dumping the decrypted information into a configuration file named config.json.

This dynamic configuration system is a key feature of Janela’s resilience. It allows the malware to adapt on the fly, switching between different C2 servers as needed. This rotation makes it harder for security teams to block communications and shut down the operation, effectively giving the malware a list of backup phone numbers to call home.

Browser Hijacking for Maximum Data Harvest

Perhaps the most invasive part of the attack is the browser compromise. The scripts actively scan the victim’s system for installed Chromium-based browsers, such as Google Chrome or Microsoft Edge. They then surreptitiously modify the browser’s launch parameters to load the malicious extension silently, without any user approval or notification. It is a masterclass in bypassing built-in security controls.

Once installed, this rogue extension establishes a native messaging host to communicate with other components. Its functionality, including a function tellingly named “CollectRefresh,” acts as a vacuum cleaner for personal data. It systematically harvests system details, cookies, browsing history, lists of installed extensions, and even information about all open tabs. The extension is programmed to spring into action, triggering specific RAT functions, when it detects the user visiting URLs matching certain patterns, like those of online banking portals. Why dig through an entire hard drive when you can simply watch over the user’s shoulder as they log in?

Evasion and Persistence in a Connected World

Janela RAT is not a blunt instrument; it is a precise, patient tool. After exfiltrating data, it establishes encrypted WebSocket connections to C2 domains that are themselves hidden using base64 encoding. The malware remains dormant during periods of inactivity to avoid drawing attention and uses obfuscated binaries to evade signature-based antivirus detection. These techniques are all geared toward one goal: maintaining long-term, undetected access to the victim’s system for continuous credential theft and data exfiltration.

In a recent technical alert marked TLP: Clear, security analysts at KPMG highlighted the campaign’s concerning sophistication. They emphasized Janela’s sharp focus on financial data and urged organizations to enhance monitoring for subtle network and system anomalies. The quiet theft of a session cookie can be far more valuable than a noisy ransomware explosion.

Key Indicators for Threat Hunters

For security teams on the front lines, vigilance is paramount. Monitoring for specific Indicators of Compromise (IoCs) can provide early warning. Suspicious network traffic to domains like w51w.worldassitencia[.]com or team000analytics.safepurelink[.]com should raise immediate red flags. Similarly, connections to IP addresses such as 191.96.79[.]24 or 189.89.15[.]37 are strongly associated with this campaign.

On the endpoint, file hashes provide a digital fingerprint for the malware. Examples include the SHA-256 hash 6550ea36af6d367e39b948835738f76d. A full list of these hashes, along with other technical details, is available in the comprehensive report published by KPMG’s cyber response team.

Building a Defensible Position Against Adaptive Threats

So, what practical steps can organizations take? The first is immediate proactive hunting: scan your environments for the published IoCs using Endpoint Detection and Response (EDR) tools. Foundational hygiene is non-negotiable; ensure all Windows systems are fully patched and enforce multi-factor authentication (MFA) universally to mitigate the impact of stolen credentials. Conducting full threat assessments to identify and shore up weak points in your digital armor is also crucial.

Beyond reactive measures, experts recommend integrating machine-readable threat intelligence feeds in formats like STIX/TAXII or via platforms like MISP. This enables real-time defense updates, turning your security infrastructure into a learning system. Engaging in preemptive threat hunting services and having a retainer for expert incident response can make the critical difference between a contained event and a catastrophic breach.

Looking ahead, the Janela campaign is a potent reminder that the threat landscape is not static. Adversaries are continuously refining their tools, leveraging legitimate infrastructure like GitLab, and exploiting the trust users place in familiar software update mechanisms. The next evolution may involve even deeper cloud integration or AI-assisted social engineering. For defenders, the lesson is clear: security must evolve from a perimeter-based mindset to one of continuous assumption of breach, focusing on detection, lateral movement prevention, and limiting the value of any single stolen credential. The race is not just about building higher walls, but about creating smarter sentinels who can spot the enemy already inside the gates.