SilabRAT is an advanced financially motivated Remote Access Trojan marketed as Malware-as-a-Service since late 2025 by the threat actor o1oo1. It focuses on stealing credentials and compromising cryptocurrency wallets through automated password cracking. Key technical capabilities include Hidden Virtual Network Computing (HVNC) for invisible remote control, browser profile cloning to evade session protections, bypassing Chrome App-Bound Encryption, session hijacking, keylogging, clipboard monitoring, and remote desktop control. The malware uses ChaCha20-Poly1305 encryption to secure its command-and-control traffic. Distribution occurs primarily through phishing and ClickFix campaigns, with infrastructure hosted by operators. The developer also offers AsmCrypt, a crypter service that complements SilabRAT by providing evasion and execution capabilities, forming a comprehensive malware bundle.

SilabRAT enables attackers to gain persistent, stealthy remote access to infected systems, facilitating credential theft and unauthorized access to cryptocurrency wallets. Its ability to bypass Chrome App-Bound Encryption and perform session hijacking increases the risk of account compromise and unauthorized transactions. Keylogging and clipboard monitoring further expose sensitive information. The malware's encrypted communications and evasion techniques complicate detection and response efforts. Financial losses and data breaches are the primary impacts associated with infections.

There is no specific patch or official fix available for SilabRAT as it is malware rather than a software vulnerability. Mitigation should focus on preventing infection vectors such as phishing and ClickFix campaigns through user awareness and email security controls. Employ endpoint detection and response solutions capable of identifying behaviors associated with SilabRAT, including HVNC activity, browser profile cloning, and session hijacking. Network monitoring for known indicators such as the IP 91.199.163.124 and associated file hashes can aid in detection. Use updated anti-malware tools and consider blocking or monitoring traffic encrypted with ChaCha20-Poly1305 if suspicious. Since this is a malware-as-a-service offering, maintaining strong credential hygiene and multi-factor authentication can reduce impact.