Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

Hackers can now rent a Windows-focused remote access tool called VectraRAT for $250 a month, lowering the barrier to deep and persistent compromise.

The malware gives paying operators a way to watch victims, steal data, run commands, and move traffic through an infected computer. VectraRAT has surfaced as a rental-only malware service rather than a one-off tool used by a single group.

Investigators linked it to campaigns that use the Amadey loader and ClickFix pages, where fake verification prompts persuade people to run copied commands on their own devices.

SOCRadar said in a report shared with Cyber Security News (CSN) that its Threat Research Unit identified the previously undocumented platform after an exposed online directory revealed samples, server files, licenses and operator logs.

The investigation began on June 23 and expanded to more than ten related servers. The risk is not limited to home users. Of the victim entries with operating-system data, 48 percent were corporate Windows editions, including Enterprise and Windows Server 2025.

Researchers recorded 38 genuine victim sessions in less than a week, with evidence of file theft from business systems.

Hackers Can Rent VectraRAT for $250

The developer, operating as Vectra and previously known as Nyxel, keeps the source code and rents access to the control server, Windows implant, payload builder and support channel.

This model allows customers to launch operations without having to develop their own remote-control malware or maintain a complete command system.

VectraRAT is different from many forum offerings because its Linux server, Windows implant, management panel and network protocol appear to have been built together, rather than repackaged from leaked code.

That does not make it invisible, but it can complicate detection rules built for familiar malware families, as recent Windows RAT credential theft cases also show.

Once installed, the implant can open a hidden desktop that victims do not see, record keystrokes, run Command Prompt or PowerShell, transfer files and turn a compromised system into a proxy.

It also collects browser credentials, network details and configuration files containing possible API keys or database strings when it first connects.

The tool includes a privilege-escalation option that can raise its access level without displaying a Windows prompt. Its approach abuses trusted Windows processes, a pattern that mirrors concerns raised by Windows account-control bypasses and gives an intruder more freedom to access protected data or deploy follow-on malware.

ClickFix Delivery Raises the Stakes

Researchers observed buyers delivering VectraRAT through Amadey and through ClickFix lures impersonating TurboTax. In a ClickFix attack, a fake CAPTCHA or verification page instructs the visitor to open the Run dialog and paste a command, converting a social-engineering trick into malware execution.

Recent ClickFix malware attack reporting illustrates how widely the tactic is being adapted. The operators can also change the implant’s callback address after installation, reducing the need to rebuild and redistribute the file when infrastructure changes.

The malware uses a custom TCP-based communication method over a non-standard channel rather than normal web traffic, while the panel and related services use separate ports.

For defenders, the most practical prevention step is simple: a website that tells a person to open Run, Command Prompt, Terminal or PowerShell and paste a verification command is not legitimate.

Security teams should block the listed infrastructure, hunt for the host and network indicators below, and investigate unexpected child processes launched by Windows auto-elevation utilities.

They should also watch for unusually long outbound connections, especially where the traffic has no recognizable application pattern at all.

Monitoring copied-command activity and PowerShell launched soon after clipboard writes can help catch the delivery chain early, a safeguard reinforced in coverage of ClickFix phishing campaign tactics.

VectraRAT shows how a modest monthly subscription can give less-skilled criminals a ready-made route to credential theft and lasting access inside Windows networks.

The combination of broad delivery campaigns, automated collection and corporate victims makes rapid blocking, endpoint review and user awareness essential.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0	VectraRAT-related sample hash
SHA-256	dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae	VectraRAT-related sample hash
SHA-256	ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9	VectraRAT-related sample hash
SHA-256	b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e	VectraRAT-related sample hash
SHA-256	bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5	VectraRAT-related sample hash
SHA-256	c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5	VectraRAT-related sample hash
SHA-256	8745e872ff8aa41b0e03737f76bf35b6c934106c987dff98afe34120e47caf91	VectraRAT-related sample hash
SHA-256	bba58f99e14e3512c04a5a74a079d7851abf935dd258cff4c80874ce7cfc82e3	VectraRAT-related sample hash
SHA-256	d8f15ba122cd6da01f83fe05294df80a6eadbce0f66dac7c2bcc0904f066e0de	VectraRAT-related sample hash
SHA-256	3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7	VectraRAT-related sample hash
SHA-256	7b82f08120e0d9b16cd5b9ec59d24fb68e35735c82311a233d370e7f264af650	VectraRAT-related sample hash
SHA-256	b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620	VectraRAT-related sample hash
IP address	86.109.75.168	Primary command-and-control server and operator panel; exposed directory
IP address	86.109.75.161	ClickFix distribution panel associated with the listed domain
Domain	verify-cloud.digital	Domain resolving to the ClickFix distribution infrastructure
IP address	178.16.54.148	ClickFix panel serving VectraRAT and NetSupport RAT
IP address	195.20.115.77	Secondary VectraRAT cluster with exposed panel and directory
IP address	91.219.236.179	Related ServerAstra infrastructure
IP address	91.92.242.236	Amadey panel and VectraRAT staging infrastructure
IP address	195.63.145.106	Infrastructure sharing the VectraRAT communication port with Vidar
Mutex	LocalVectra.Client.SingleInstance	Static mutex used by the implant to prevent multiple instances
File path	%TEMP%callback.json	Callback override file used to update the embedded server address
PE resource	RT_RCDATA 1001	JSON configuration resource that can contain uacEnabled
Network port	TCP 3308	VectraRAT command-and-control protocol
Network ports	TCP 8080, 8888	Operator-panel ports
Network ports	TCP 4457, 6667	Auxiliary infrastructure ports
PE metadata	Product Vectra, Company Vectra, version 0.2	Default metadata associated with unmodified VectraRAT stubs
URL path	/clickfix/5WwYUnxSRq/file on port 8081	ClickFix delivery path used to serve the payload

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC