Threats Tagged 't1518'

The Powercat malware campaign observed in February 2026 distributes an infostealer disguised as cheat software for popular PC games like Roblox, Minecraft, and Grand Theft Auto V. It uses a multi-stage infection chain involving an initial executable for profiling and persistence, followed by a Java-based loader that deploys the infostealer. The malware targets cryptocurrency wallets, browser data, Discord tokens, and gaming accounts with payment information. It also includes surveillance features such as keylogging, webcam capture, and screen recording. The campaign primarily targets children on gaming platforms and pay-to-cheat websites, with indications that stolen personal data may be used for blackmail or coercion into illegal activities.

A previously undocumented remote access tool named LabubaRAT has been identified, masquerading as NVIDIA software through fake metadata and runtime artifacts. This Rust-based malware creates persistent footholds enabling hands-on operator activity including host profiling, security tool identification, command execution, file transfers, screenshot capture, and traffic proxying. The implant supports multiple communication methods including HTTPS polling, WebView2-based communication, and DNS tunneling. It uses a configurable framework model with organization, group, server, and API key parameters suggesting a Malware-as-a-Service platform. The malware maintains local state in SQLite databases and provides comprehensive remote access capabilities including PowerShell and JavaScript execution, SOCKS5 proxy support, and user-level persistence through registry autoruns. Infrastructure analysis revealed LabubaPanel branding with associated command and control servers hosted on German providers.