An exposed backend server is actively generating new, polymorphic versions of the Banana RAT banking trojan, complicating detection for defenders.