RAT Archives

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

AppWizard

July 20, 2026

15 years before Dishonored, Thief devs considered letting Garrett shrink himself rat-sized so he could scurry through drains and mouse holes

Corvo Attano, the protagonist of Dishonored, possesses the unique ability to inhabit various creatures, including rats, allowing him to access otherwise unreachable areas. This concept was considered for Thief: The Dark Project over a decade earlier. Both Thief and Dishonored feature stealthy protagonists embroiled in political intrigues, but Garrett from Thief lacks supernatural powers and relies solely on stealth. Thief emphasizes navigating environments without detection, while Dishonored allows for combat if stealth fails. Thief's focus on stealth mechanics has significantly influenced the genre. Recently, Thief has gained attention due to the announcement of a remaster, Thief: The Dark Project Remastered, by Nightdive Studios, which will include additional missions and enhancements. Original artist Daniel Thron is involved in revitalizing the game's cutscenes. A release date for the remaster has not been announced, but excitement within the gaming community is high.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

AppWizard

July 12, 2026

Going from skull-cracker to safecracker in Dishonored 2

The author reflects on their experience playing Dishonored and its sequel, detailing their initial chaotic playstyle that led to a High Chaos ending. They express a desire to adopt a stealth approach in the game, facing challenges from the Chaos system and the deteriorating state of the city. In Dishonored 2, they aim for a flawless run without kills or detections, which requires extensive planning and execution. The Clockwork Mansion mission tests their resolve, particularly when confronting the character Kirin Jindosh and solving the Jindosh Lock puzzle. The author ultimately finds satisfaction in solving the puzzle independently, using creativity and notes to aid in their success.

Winsage

July 8, 2026

Trojanized LetsVPN installer gives attackers remote access to Windows PCs

A malware campaign has been discovered that exploits the VPN service LetsVPN. Researchers from ThreatLocker found a malicious Windows installer that pretends to be the legitimate LetsVPN application while deploying a remote access trojan (RAT) called GoodPersonRAT. The malware allows attackers to control infected systems using stealth techniques. The malicious installer first deploys the RAT and then installs the authentic LetsVPN application, creating an illusion of legitimacy. The package identified as Kuailian_win-setup.86.msi contains the legitimate LetsVPN installer, a loader, and an encrypted payload. GoodPersonRAT features include remote desktop control, file upload/download, command execution, proxying, keylogging, and clipboard monitoring. It specifically targets Telegram Desktop users by archiving critical account information and altering proxy settings. The malware ensures persistence through Windows services and scheduled tasks and can undermine security software. The LetsVPN installer is legitimate and signed, but the MSI package is unsigned and contains malicious components. Users are advised to download software only from official sources and verify digital signatures.

Winsage

June 27, 2026

New Millenium RAT version infects 62,000 Windows systems worldwide

A significant evolution of the Millenium remote access trojan (RAT) has impacted over 62,000 Windows devices across more than 160 countries. The latest version, 4.*, marks a departure from previous .NET-based versions and is attributed to a threat cluster known as Y2K Operators, with the creator identified as “ShinyEnigma.” There are 62,289 infected endpoints, with 39,730 infections occurring in the first quarter of 2026. The RAT is marketed as malware-as-a-service (MaaS) and promoted through underground forums and platforms like GitHub, with accessible pricing. Millenium RAT 4 is developed in native C++ and uses the Telegram Bot API for command-and-control communications. Its capabilities include stealing browser data, collecting system information, logging keystrokes, capturing screenshots and audio, accessing Telegram and Discord data, downloading additional payloads, and executing Windows or PowerShell commands. The malware ensures persistence by replicating itself in the %APPDATA% directory and creating an autorun registry entry. The malware is distributed through social engineering tactics such as cracked software, cryptocurrency utilities, hacking toolkits, OSINT tools, exploit builders, and Roblox-related cheats. Some campaigns have trojanized malware builders, infecting cybercriminals. One campaign used PDF-themed lures with a malicious Windows shortcut to download the RAT while displaying a legitimate document. Payloads often use filenames associated with Windows components or security software to blend into infected systems. Group-IB recommends avoiding untrusted executables, applying security updates, enabling multi-factor authentication, and monitoring for unusual autorun registry entries.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

AppWizard

June 21, 2026

Dishonored review (2012)

The review of Dishonored in PC Gamer issue #246 (December 2012) highlights the game's immersive experience, customization options, and technical execution. The reviewer describes a gameplay moment where they successfully eliminate an enemy after a miscalculated leap. The PC version offers extensive customization, including field-of-view adjustments and graphics settings. The game runs smoothly on a 2.8GHz Core i7 with a 2GB GeForce GTX 670 graphics card. Dishonored is noted for its originality as a major title that is neither a sequel nor a remake, and it avoids unskippable boss fights, enhancing player freedom and engagement.

AppWizard

June 15, 2026

PC Bundle Offering 39 Games At $61 Saving For Limited Time Only

PC gamers can celebrate Pride Month with the Townsqueer Vol. 1 bundle, which includes 39 games and zines focused on LGBTQ+ themes. The bundle is priced at a significant discount compared to purchasing the games individually, and proceeds are shared among creators. Notable titles in the bundle include "Tell Me Why," featuring a trans protagonist, and various other games and zines that highlight diverse queer experiences. The bundle is available on itch.io, with options to purchase individual titles.

AppWizard

June 9, 2026

Surely FromSoftware has something brewing besides that Switch 2 exclusive, right?

FromSoftware announced a network test for the game Duskbloods, exclusive to the Switch 2, during the recent Nintendo Direct. The game features a trailer with atmospheric visuals and ominous narration. Fans are speculating about its implications for a potential Bloodborne 2 and expressing disappointment over its exclusivity to the Switch 2. Additionally, the Tarnished Edition DLC for Elden Ring is set to release on August 28, introducing two new classes and new weapons and armor.