RATs and the invisible remote control

There's a kind of intrusion that doesn't just want to steal a file and vanish. It wants to stay. It wants to watch the screen, log what you type, open folders, move the mouse and wait for the right moment to act. That's the RAT, short for Remote Access Trojan.

NOTE: Links to the chronological table from my research.

CERT.br describes it as the combination of a Trojan horse with a back door. First comes the trick that gets the program onto the device. Then a channel stays open for the criminal to come back. The most uncomfortable difference is right there: many actions aren't decided by the malware. There's a person on the other side watching the context and choosing the next step.

That changes the nature of the attack. Automated code looks for files, passwords or cryptocurrency wallets by following rules. An operator can wait for you to open your bank, put up a fake screen right at that moment, hide a transaction and change approach if they notice something went wrong.

Not all remote access is a RAT #

The name tends to be used for different situations. Separating the categories avoids alarmism and helps you understand the real risk.

The most useful question is a simple one: did I ask for this access, do I know who is connected and can I end the session? If the answer is no, the technical name becomes a detail. There's already an incident.

What changes when someone is operating #

A RAT can bring together screen capture, keylogging, camera, microphone, location, reading notifications, copying files and running commands. Not every family has all of these functions, but the principle is the same. The device stops answering only to its owner.

In bank fraud, the operator doesn't need to guess the right moment. They can see when the person opens the app, cover the screen with a dark layer, show a fake window and work underneath it. In spying, they can go after a specific folder, pick out conversations and turn on sensors. In a company, they can use the first machine as a way in to reach internal accounts and systems.

The danger doesn't end when the support window closes, either. If the intruder installed another component, created an automatic startup entry or stole credentials, uninstalling the visible program doesn't solve everything.

How the scam gets to control #

Brazilian cases change their packaging, but they repeat a known chain. The bait can be a bill, a tax document, a fake update, a government benefit, a file sent over WhatsApp or a call from the supposed bank support.

Then comes the victim's action. On a computer, you see ZIP, LNK, MSI, scripts or pages that tell you to open Run and paste a command. That trick is called ClickFix. On Android, the bait tries to lead you to a fake APK and asks for access to Accessibility, reading notifications, screen overlay or installing other apps. In fake support, the person themselves installs a legitimate remote tool and hands over the session code.

Once the program manages to run, it tries to stay available. It can create a startup entry, install a service, hide a window or keep a periodic connection to the command and control server. Only then does the operator get the screen, the commands and the data needed to act.

Figure 1. The chain sums up recurring behaviors. A campaign can skip steps, swap tools or combine malware with legitimate software.

What thirty years of names reveal #

The PDF this piece is based on gathered 300 families and tools associated with remote access between 1989 and 2018. The author herself treats the list as a curated sample, not a census of every RAT in existence. The year 2018 was also incomplete.

Even with those limits, the distribution is revealing. Of the 300 items, 217 appear from 2010 on. That's 72% of the sample. It doesn't prove that 72% of all RATs were born in that period. It shows that the densest part of the catalog is concentrated in the years when builders, panels, reused code and the sale of access made this kind of tool easier to get and operate.

Figure 2. Distribution of the 300 items in the third version of the study. The sample is curated, not exhaustive, and 2018 was incomplete.

The story isn't just one of growing numbers. The targets and the devices changed. The RAT left the home computer and reached the phone, the corporate environment and financial fraud carried out live. It also became a service. Whoever buys a ready-made kit doesn't need to master every part of the code to spy on or control a victim.

In Brazil, remote control meets money #

CERT.br itself uses interactive control during an Internet Banking session as an example. It's no accident that so many cases seen in the country mix RATs, banking trojans and fraudulent remote support.

In 2019, BRATA showed how this risk worked on Android. One of the campaigns used a fake WhatsApp fix. The app abused Accessibility to monitor the screen, capture credentials, read messages and gain broad control of the phone. It even showed up on Google Play, a reminder that an official store reduces the risk but doesn't replace paying attention to the developer and the permissions requested.

In 2021, ESET documented Janeleiro, aimed at corporate users in Brazil. It watched browser windows and let the operator show fake banking screens on demand. The name looks like JanelaRAT, but they're different families. Janeleiro is a banker. JanelaRAT is a financial RAT documented years later.

Grandoreiro helps show this contact zone. It's a banking trojan, not a generic RAT, but it gives the operator screen locking, keylogging, mouse and keyboard simulation and fake pop-ups. In January 2024, the Federal Police carried out an operation against its infrastructure with technical support from ESET.

There are also attacks with no RAT in the first step. Mandiant investigated a group that phoned employees of Brazilian companies pretending to be IT support. The victim installed AnyDesk and handed over access. In other chains, the group used remote management tools and malware too. The same operation can combine legitimate software, stolen credentials and a backdoor.

WhatsApp became another shortcut. In October 2025, Kaspersky blocked 62 thousand infection attempts by the Maverick banker in Brazil during the first ten days of the campaign it analyzed. The ZIP file came from compromised accounts, started a chain on Windows and even tried to hijack WhatsApp to keep spreading. That's one company's telemetry, not 62 thousand infected people.

In 2026, the scene kept arriving through familiar paths. CTIR Gov warned about fake or compromised pages that imitated government services and distributed malware. It also described ClickFix-style pages that told the victim to copy a command into Windows. On phones, researchers found BTMOB in a campaign aimed at Brazil. The RAT was distributed through fake pages and malicious apps, captured the screen, collected data and took over the device.

In the same period, Kaspersky reported that its telemetry had recorded 14,739 attacks linked to JanelaRAT in Brazil in 2025. Again, a detected attack isn't the same as a unique victim, a completed infection or a national total.

Figure 3. The historical line and the Brazilian cases were kept apart so as not to confuse a worldwide sample with national incidence.

The size of the problem we can't measure #

Brazil shows up again and again in security research, targeted campaigns and police operations. That's evidence of activity, not a national RAT rate.

The public databases I consulted from CERT.br and the Federal Police work with broader categories. They don't offer a dedicated series that could answer how many RATs infected Brazilians or how much this kind of attack grew. CERT.br's reports are voluntary, and the numbers from security companies depend on the customer base and the products each one can observe.

That's why detection, attempt, attack and victim can't be swapped as if they were the same thing. One device can generate several detections. A blocked attempt may not produce an infection. A campaign studied in Brazil doesn't represent every campaign in circulation.

That limitation doesn't weaken the warning. It only keeps a real threat from being explained with made-up statistics.

Signs that deserve attention #

A cursor moving on its own, a black screen while using the bank, a camera or microphone turned on for no reason, an unknown app with access to Accessibility and messages sent from your own WhatsApp are important signs. It's also worth being suspicious of a remote tool installed after an unsolicited call from a bank, the government or support.

None of these signs, on its own, confirms a RAT. A driver glitch can mess with the screen. A legitimate app can use Accessibility. The diagnosis comes from the whole picture: an unexpected install, broad permissions, a remote connection, an account change and behavior the person didn't start.

In companies, the investigation needs to look at the sequence. A new remote agent, followed by automatic startup, a long external connection and PowerShell or Command Prompt opening, is more significant than an isolated executable. Portable tools matter too, since they can run without a traditional install.

What to do when suspicion shows up #

Prevention without turning everything into fear #

Don't open a ZIP, LNK, MSI, APK or urgent fix just because it came from someone you know. Their account may have been compromised. Confirm through another channel. Close pages that tell you to press Win+R, paste a command or open PowerShell to prove you're not a robot.

On Android, check the developer and treat Accessibility, screen overlay, reading notifications, camera, microphone and installing other apps as high-impact permissions. On the computer, keep the system, browser and antimalware up to date. Turn on two-factor authentication on important accounts.

In companies, remote tools need an inventory, owners and rules. Allowing only approved solutions, requiring strong authentication, limiting privileges, logging sessions and monitoring connections makes abuse more visible. Training should also cover fake support, WhatsApp and ClickFix, not just the old email attachment.

The central point is simple. A RAT isn't just malicious software. It's a hidden human presence inside the device. Defense starts when we treat attachments, copied commands, permissions and requests for remote access as security decisions, not as trivial support steps.

References gathered at the end to keep the reading clean.

• Veronica Valeros and Stratosphere Laboratory. A Study of RATs and Third Timeline Iteration.

• CERT.br. Códigos Maliciosos, Cartilha de Segurança para Internet (Malicious Code, Internet Security Booklet).

• CERT.br. RAT command and control server.

• CERT.br. Incident Statistics.

• Federal Police. Statistical Data on Fighting Cybercrime.

• GSI. Guidance on security in remote access solutions.

• CTIR Gov. Recommendation 02/2026.

• CTIR Gov. Recommendation 03/2026.

• CISC Digital Government. Malware using WhatsApp.

• ENCCLA. The fake technician fraud and abuse of remote access software.

• MITRE ATT&CK. Remote Access Software, T1219.

• Kaspersky. BRATA: Android RAT first observed in Brazil.

• ESET Research. Janeleiro: banking trojan aimed at corporate users in Brazil.

• ESET Research. Operation against the Grandoreiro banking trojan.

• Google Cloud and Mandiant. BREEZE COMET targets Brazil.

• Kaspersky GReAT. Maverick banker distributing via WhatsApp.

• Kaspersky GReAT. JanelaRAT: a financial threat targeting users in Latin America.

• ESET Research. BTMOB: A stealthy RAT burrowing deep into Android devices.