CrystalX RAT: a Trojan for pranks, remote access, and cryptocurrency theft | Kaspersky official blog
Source Kaspersky Security Blog
Russia
United States
Germany
United Kingdom
China
India
Brazil
South Africa
Australia
Canada
France
Japan
Turkey
Poland- remote
Description
The new CrystalX remote access Trojan combines pranks with full control over the victim’s computer. It also spies on its victims, steals their cryptocurrency and accounts, and uses advanced methods to bypass protection. We explain how it works, and how to avoid infection.
Impact
CrystalX RAT poses significant risks to both individual users and organizations worldwide. Its ability to steal credentials from widely used platforms and browsers threatens account security and privacy. The clipboard hijacking technique specifically endangers cryptocurrency holders by redirecting funds to attackers. Full device control enables attackers to conduct surveillance, exfiltrate sensitive data, and disrupt normal operations by disabling input devices and system utilities. The prank-like features may initially distract victims, delaying detection and response. The malware’s MaaS distribution model democratizes access to powerful attack tools, potentially increasing the volume and diversity of attacks. Organizations may face data breaches, financial losses, and reputational damage. The threat is particularly concerning for sectors with high cryptocurrency usage, gaming communities, and users of communication platforms like Discord and Telegram. The malware’s anti-analysis features complicate detection and forensic investigation, increasing remediation costs and efforts.
Defensive guidance
To mitigate the risk of CrystalX RAT infections, organizations and users should implement a multi-layered security approach. First, avoid downloading software from unofficial sources, pirated software, or untrusted links, especially those promoted via social media or messaging apps. Educate users to recognize suspicious behavior such as unexpected screen rotations, locked input devices, or unsolicited notifications, and to immediately disconnect from networks if such symptoms occur. Employ endpoint protection solutions capable of detecting and neutralizing CrystalX, such as Kaspersky Premium, and ensure these solutions are kept up to date. Use application whitelisting and restrict execution of unauthorized software. Enable two-factor authentication and passkeys on critical accounts to reduce credential theft impact. Regularly update operating systems and applications to patch vulnerabilities that could be exploited for initial infection. Monitor clipboard activity for suspicious changes in cryptocurrency wallet addresses. Limit user privileges to reduce malware impact and disable unnecessary services that could be exploited. Finally, maintain offline backups and incident response plans to quickly recover from infections.
Summary
CrystalX RAT is a sophisticated Windows-based remote access Trojan discovered in early 2026 and marketed as malware-as-a-service (MaaS) primarily via Telegram channels. Unlike traditional RATs, CrystalX blends prankware features—such as screen rotation, mouse button swapping, and disabling keyboard input—with advanced spying and theft capabilities. It can steal login credentials from popular platforms including Steam, Discord, Telegram, and all Chromium-based browsers. A key feature is clipboard monitoring and replacement, enabling attackers to hijack cryptocurrency transactions by substituting wallet addresses. The malware also includes keylogging, full remote control over the victim’s device, and access to the camera and microphone for surveillance purposes. CrystalX employs strong encryption (ChaCha20 with 256-bit keys) and compression to generate unique builds per customer, complicating detection. It detects virtual machines and debugging environments to evade analysis. The initial infection vector remains unknown, but telemetry shows early victims mainly in Russia. The RAT’s control panel offers extensive customization, including geographic targeting and anti-analysis options. The MaaS model lowers the barrier to entry for attackers, as users with minimal skills can rent the malware and use instructional videos to operate it. Kaspersky products currently detect and neutralize CrystalX, but the malware’s evolving nature and aggressive marketing suggest a growing threat landscape.
References
Community reviews
Related threats
- Fresh WordPress Vulnerability in Attackers’ CrosshairsHighVulnerability
- php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability
- ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability