StealC malware has resurfaced as Stadia, a remote access trojan (RAT) that incorporates StealC's original code. Stadia extends capabilities beyond simple data theft to include hidden desktop control, live command shell, file management, process management, and in-memory loading. It communicates via plain HTTP to hardcoded IPs using RC4 encryption with Base64 encoding and persists through hidden scheduled tasks in randomized directories mimicking legitimate updaters. The operator targets former StealC customers with subscription offers. No official patches or fixes are available, and no known exploits in the wild have been reported.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
KGB RAT is a Windows Remote Access Trojan actively marketed on underground forums since late 2025. It is sold as Malware-as-a-Service with prices ranging from $150 to $800. The malware includes features such as credential theft, keylogging, hidden desktop takeover, ransomware, and psychological harassment tools like screamers and forced blue screens. It uses a daily updated fully undetectable (FUD) crypter to evade detection by Windows Defender and communicates with its command and control (C2) servers without requiring port forwarding. Notifications are delivered via Telegram. The malware is based on the NjRAT framework and includes a CryptoClipper module that swaps cryptocurrency wallet addresses. Development reportedly began in early 2022.
In late September 2026, seven malicious npm packages impersonating a NebulaAI SDK were deployed to deliver a Windows remote-access trojan (RAT). The RAT uses direct NT and win32k syscalls, avoiding DLL imports, and includes features such as hidden-desktop remote control, camera and microphone monitoring via Kernel Streaming, and persistence through Winlogon Shell. The malware communicates with a command-and-control server at 65.87.7.132 and disguises itself as conhost.exe while employing anti-analysis techniques.
RemotePanel and BoundSiphon are two previously undocumented .NET malware components delivered via a ClickFix infection chain. RemotePanel masquerades as the Windows Time service to establish persistent remote access, offering operators PowerShell control, file and process management, screen access, modular hidden VNC, and fleet management. It uses a BNB Smart Chain contract to dynamically resolve its active command and control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon operates primarily in memory, targeting browser credentials, sessions, cryptocurrency wallets, password manager data, and documents protected by Chromium App-Bound Encryption. The modular design separates persistent access from data theft, allowing operators to swap components independently while maintaining operational capabilities. No known active exploitation or patches are reported.
A compilation artifact, specifically a developer's home directory path (/home/tcherber/.cargo/), linked multiple malware families including a Rust-based infostealer named Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker ransomware to a single developer. The infostealer exfiltrates cryptocurrency wallets, browser credentials, Office documents, and VPN configurations. The HVNC tool enables hidden remote desktop sessions and implements AMSI and ETW evasion techniques. Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS. Multiple droppers written in C, Rust, and PowerShell were discovered delivering the malicious payloads. Build timestamps indicated development occurred within weeks, and infrastructure leaked evidence of additional tools including FUD-Crypter, Botnet, and C2 Agent components, demonstrating how overlooked compilation artifacts enable comprehensive attribution and threat mapping.
Between May and July 2026, researchers tracked the Latin America-focused threat actor Blind Eagle through multiple exposed staging servers, identifying significant toolkit evolution. Four key developments emerged: a third string-obfuscation scheme featuring JavaScript with custom AES S-box substitution, a RunPE loader using bare AutoIt3 interpreter staged via GitHub, a reusable 'Photo Studio' persistence mechanism shared across three distinct toolchains, and a materially upgraded AsyncRAT variant codenamed JC-46. This enhanced RAT incorporates Windows Notification Facility process injection, custom Base28 encoding, Hidden VNC banking-fraud capabilities with browser profile cloning, and a Chrome App-Bound Encryption v20 bypass. Despite operational security weaknesses including exposed directories and hardcoded credentials, the group demonstrates selective sophistication targeting banking operations across Spanish-speaking regions.
SilabRAT is an advanced Remote Access Trojan offered as Malware-as-a-Service on Darkweb forums since late 2025, developed by threat actor o1oo1 and sold for $5,000 monthly. This financially-motivated tool focuses on credential theft and cryptocurrency operations, featuring Hidden Virtual Network Computing for invisible remote control, browser profile cloning to bypass session protections, and automated cryptocurrency wallet password cracking. The RAT bypasses Chrome App-Bound Encryption, performs session hijacking, and includes keylogging, clipboard monitoring, and remote desktop capabilities. Distributed through phishing and ClickFix campaigns with operator-hosted infrastructure, SilabRAT uses ChaCha20-Poly1305 encryption for command-and-control communications. The developer also offers AsmCrypt, a companion crypter service, creating a complete malware bundle from evasion to execution and remote control.
CrySome is a sophisticated .NET-based remote access trojan designed for persistent command-and-control operations. It features advanced persistence mechanisms, including recovery partition abuse and offline registry modification, allowing it to survive system resets. The malware incorporates an aggressive defense evasion module, disabling security products and blocking updates. Key capabilities include command execution, file operations, surveillance, credential theft, and hidden virtual desktop control. CrySome's modular architecture and structured packet-based protocol enable a wide range of remote operations. Its emphasis on stealth, resilience, and comprehensive system control makes it a significant threat for long-term covert access to compromised environments.
A Vietnamese threat actor is employing AI to develop code for an ongoing phishing campaign delivering PureRAT malware and other payloads. The attacks begin with phishing emails disguised as job opportunities, potentially targeting work computers. The attacker's use of AI is evidenced by detailed comments and numbered steps in scripts, as well as instructions in debug messages. The attack chain involves malicious archives, sideloaded DLLs, and batch scripts likely authored using AI. The attacker appears to be continually refining their methods and may be selling access to compromised organizations. This case demonstrates how AI can lower the barrier to entry for less skilled attackers, helping them write code and build attack toolkits.
