Abe Office RAT bypasses Chrome App-Bound Encryption to steal passwords
The signed AbeAgent.exe uses a default password, injects a helper into off-screen Chrome, and was seen operating in a sandbox.
Stories per day · 30 days
9 RSS
Relatedinfostealer6android3windows3accessibility2cikabika2clickfix2credential-theft2darkcore2discord2group-ib2hvnc2keylogger2kgb-rat2malware2ngrok2njrat2ransomware2rust2
83 stories, newest first · one card per story
Stories tagged #rat
Adobe Commerce and Magento StyleSmuggler Zero-Day Exploited for RAT Deployment
Attackers use StyleSmuggler flaw to install PSK Agent RAT and maintain remote access on Magento stores.
1
Talos finds NIK C2 Windows RAT that calls OpenAI from infected PCs
The Go implant runs more than 52 commands, bills the victim’s OpenAI key, and shows a lock screen without encrypting files.
ICMacOS Mac malware sold for $699 a week with remote commands
Version 2 adds a WebSocket shell and LaunchAgent persistence while still stealing developer and wallet secrets.
DarkCore RAT marketed to reuse Gmail and WhatsApp sessions
BlackFog verified a Windows sample’s config and modules, not every seller-advertised browser feature.
DarkCore RAT Enables Session Hijacking of Gmail and WhatsApp
DarkCore RAT allows attackers to hijack authenticated sessions in Gmail, WhatsApp and MediaFire using stolen cookies without needing passwords, requiring an existing endpoint foothold.
StealC seller relaunches as Stadia RAT for Windows
Version 1.1.2 adds hidden desktop control, a shell, and a loader; Varonis ties its helper to StealC 3.5.
Rust-based CikaBika Bot uses Discord as its command center
A Nim loader and PowerShell UAC bypass try to plant the payload as Edge’s dbghelp.dll.
Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
Android RAT YuanKong leaks operator account IDs while abusing Accessibility and Wireless Debugging to control phones.
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Any.Run found 1,258 fake Claude and ChatGPT campaigns using ClickFix to infect developers with malware.
8
New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
Star Labs analyzed YuanKong, an Android RAT using Accessibility and overlays to steal banking PINs and passwords.
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
9
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
Group-IB says KGB RAT, an NjRAT-based Windows trojan sold from $150 monthly, steals passwords, spies via webcam, and includes ransomware.
KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
Group-IB analyzed KGB RAT, a malware-as-a-service trojan based on NjRAT that steals credentials and controls PCs.
CikaBika Bot RAT Uses Discord for C&C
Darktrace reports CikaBika, a Rust RAT using Discord for C2, delivered by phishing PDFs and LNK loaders.
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
ThreatFabric details Hirudo, an Android banking RAT that swaps Indonesian bank apps for trojanized copies.
How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
Netskope says leaked XWorm builders turned the RAT into a surveillance kit with live browser, mic, and location plugins.
WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows
A WhatsApp ZIP lure deploys VulcanRAT207.A, a Windows RAT that escalates to SYSTEM and sideloads via VulkanInfo.
Inside ICMacOS: From an Infostealer to a Persistent RAT
SOCRadar analyzes ICMacOS, macOS malware that evolved from an infostealer into a persistent RAT.
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Eight malicious npm packages, downloaded 40,767 times, installed Overlord RAT and a Node.js stealer.
4
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure
Attackers use malicious ChatGPT custom GPTs and trusted OpenAI and Google domains in a ClickFix-style RAT lure.
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Huntress details attackers abusing ChatGPT Custom GPTs with ClickFix lures to deliver a full-featured RAT via DLL sideloading, infecting at least 40 users.
1
Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware
Huntress uncovered a campaign abusing ChatGPT CustomGPT 'Plus 5.6' with ClickFix to sideload a RAT via a Canon-signed app, infecting at least 40 users.