Search: “modular RAT”

141 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 142 Ransomware 85 Vulnerability 66 Threat actor 37 Exploit / PoC 12 Phishing & fraud 6 Data breach 6 Policy & legal 1 AI safety & security 1 Tools 1

SeverityAll critical 76 high 179 medium 99 low 2 info 1

The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

Huntress found tampered Exodus crypto wallet installers delivering a modular RAT that steals credentials rather than wallet funds.

Huntress analysts analyzed tampered installers for the Exodus cryptocurrency wallet that bundle a modular remote access trojan. The implant focuses on harvesting credentials instead of draining wallet balances, suggesting broader access theft. The case highlights installer tampering as a supply-chain-style delivery vector for credential-stealing tooling.

HuntressSep 1, 04:00 UTC · 15d agoMalware in the wild

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabzAug 10, 15:51 UTC · Aug 10, 2026Malware

tRat is a new modular RAT used by the threat actor TA505

Security AffairsNov 16, 12:37 UTC · Nov 16, 2018Malware

Forcepoint spotted the modular Felismus RAT, it appears the work of skilled professionals.

Security AffairsApr 2, 13:34 UTC · Apr 2, 2017Malware

FBI warns of nation

Security AffairsMar 31, 11:20 UTC · Mar 31, 2020Malware

CloudZ RAT potentially steals OTP messages using Pheno plugin

Cisco TalosMay 5, 10:00 UTC · May 5, 2026Malware

CRAT wants to plunder your endpoints

Cisco TalosNov 12, 13:18 UTC · Nov 12, 2020Malware CVE-2017-8291

AI-Generated Malware Powers New Armored Likho APT Campaign

Security AffairsJul 7, 08:28 UTC · Jul 7, 2026Malware

Threat actor abuses Gophish to deliver new PowerRAT and DCRAT

Cisco TalosOct 22, 10:00 UTC · Oct 22, 2024Malware

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.