RAT Archives

AppWizard

August 30, 2026

I want MMOs to waste our time again

The author revisited the MMO Star Wars Galaxies on a private server, experiencing its chaotic environment in Mos Eisley and reflecting on the game's charm despite its outdated graphics and minimal quests. The gameplay allowed for leisurely exploration and connection with other players, contrasting sharply with the fast-paced, task-oriented nature of modern MMOs like World of Warcraft. The author appreciated the freedom to engage with the game at their own pace, discovering player-created content and enjoying incidental interactions that evoke the essence of the MMO experience. The community surrounding Star Wars Galaxies continues to preserve its spirit, highlighting a sense of life and connection that is often lacking in contemporary MMOs.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

AppWizard

August 21, 2026

The New Rat Horror Game Is Being Pirated A Week Before Launch

Resonance: A Plague Tale Legacy has leaked online a week before its official release on August 27, allowing unauthorized copies to circulate due to compromised digital rights management (DRM). Players are sharing images and some have begun playing the game, while others are avoiding spoilers. This leak follows a trend of significant game leaks in 2026, including Forza Horizon 6 and Lego Batman. The game does not offer paid early access options and is expected to provide around 20 hours of gameplay with an action-oriented approach, including a parry system. It will also be available on day one for Game Pass Ultimate subscribers on console and PC.

AppWizard

August 16, 2026

Come September, you won’t need a single Total War: Warhammer game to play its colossal, trilogy-spanning Immortal Empires campaign

The upcoming Lords of the End Times expansion for Total War: Warhammer was announced, featuring characters like Nagash, Boris Todbringer, the Glottkin, and Grey Seer Thanquol. The expansion will launch on September 24, and players will not need previous Total War: Warhammer titles to access the Immortal Empires campaign. The Immortal Empires content includes 14 factions, 24 legendary lords, numerous Free-LC lords and heroes, and entire free factions like Bretonnia. Total War: Warhammer 3 is available for purchase during a 10th anniversary sale, but investing in the new lords may be more advantageous. The Great Vortex campaign from Total War: Warhammer 2 is integrated into Immortal Empires, making revisiting individual games less appealing for dedicated players.

AppWizard

August 16, 2026

Come September, you won’t need a single Total War: Warhammer game to play its colossal, trilogy-spanning Immortal Empires campaign

The upcoming Lords of the End Times expansion for Total War: Warhammer 3 will be released on September 24 and will feature characters such as Nagash, Boris Todbringer, the Glottkin, and Grey Seer Thanquol. The Immortal Empires campaign will be accessible without needing previous Total War: Warhammer titles, and it includes 14 distinct factions, 24 legendary lords, various Free-LC lords and heroes, and free factions like Bretonnia. Total War: Warhammer 3 is currently available at a discounted price due to a 10th anniversary sale. The expansion aims to enhance the experience for both new and returning players.

Winsage

August 16, 2026

LeakWatch CW 33/2026: Windows Zero-Day, AMD, Intel and Malware

- The August Patch Tuesday release included 421 vulnerabilities, with 236 affecting Windows, highlighting CVE-2026-68820, a critical use-after-free vulnerability that allows privilege escalation to SYSTEM level without user interaction. - CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation. - AMD's Ryzen Master software has vulnerabilities, including CVE-2025-54512 (DLL hijacking) and CVE-2026-0465 (use-after-free), which could allow code execution with elevated privileges. - AMD's advisory on CVE-2026-6726 and CVE-2026-6727 indicates vulnerabilities in the TPM 2.0 reference code affecting Ryzen platforms, leading to potential information disclosure. - Intel's advisories included updates for microcode, Wi-Fi software, and NPU drivers, with CVE-2026-20760 addressing privilege escalation risks. - Google’s Chrome update on August 11 fixed five high-severity vulnerabilities, including use-after-free flaws. - Gunra malware has evolved into a ransomware-as-a-service model using a double-extortion strategy. - WindRelay malware combines SpyNote RAT with an NFC relay component, allowing attackers to relay NFC communication between a victim's bank card and a remote device. - The findings emphasize the need to view vulnerabilities as part of potential attack chains, highlighting the complexity of modern cybersecurity threats.

Winsage

August 3, 2026

Microsoft warns Windows PC users of Russian hackers on hotel WiFi

Microsoft has issued a warning to Windows PC users about Russian hackers targeting individuals using hotel WiFi networks. The campaign, named CaptiveCrunch and attributed to the Storm-2945 group, focuses on corporate travelers and employs tactics like credential theft and malware distribution through compromised guest networks. Microsoft has been monitoring this activity since May, noting its impact on hospitality networks utilizing captive portals. Hackers have been redirecting users to counterfeit sign-in pages to steal credentials without phishing emails. The threat may also extend to Android devices, with hackers using deceptive techniques to manipulate users into downloading malicious APK files. The hackers employ fake verification checks and sign-in prompts, sometimes misleading users into Microsoft's legitimate authentication process to gain access to accounts. Microsoft has identified a specific remote-access trojan named CornFlake, which can record keystrokes, steal credentials, and capture screenshots. Recommendations for travelers include using mobile hotspots, avoiding updates through captive portals, strengthening authentication methods, and blocking unnecessary device-code authentication.

Winsage

August 1, 2026

Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users

Microsoft has issued a warning to organizations regarding the risks associated with public and hospitality network infrastructures, citing a new hacking threat from Russian cyber actors targeting travelers for malware distribution and credential theft. This warning follows the identification of a global campaign named CaptiveCrunch, linked to Storm-2945, which has been targeting corporate travelers since early May by exploiting compromised guest networks. Attackers are manipulating hospitality networks to facilitate credential theft and malware delivery, using tactics such as redirecting network traffic to counterfeit sign-in pages. The campaign affects both Windows and Android devices and employs techniques that include presenting fake verification checks and software updates. Some victims have been misled into participating in Microsoft’s legitimate device-code authentication process, allowing attackers to gain access to accounts without stealing passwords. Microsoft advises travelers to treat guest networks as untrusted and recommends using mobile hotspots, avoiding updates through captive portals, and enhancing security measures. Malicious tools identified include the Windows remote-access trojan (RAT) named CornFlake, which can steal credentials, record keystrokes, and hijack audio and video capabilities.

AppWizard

July 27, 2026

Steam Week in Review: A torrent of janky retail sims continues to flood Steam, and there’s no end in sight

The retail simulator genre on Steam has gained significant popularity since late 2024, with 14 new titles launched last week. "Mall Together" attracted over 1,000 concurrent players and is notable for allowing players to construct entire shopping malls. PlayWay, a major publisher, released two of last week's titles and has launched four games since July 20, with 474 products listed on Steam. Critics have labeled some titles as shovelware, but PlayWay has also produced successful games like "House Flipper 2." Smaller studios are contributing to the genre, indicating demand for well-crafted retail sims. The top sellers on Steam from July 14-21 included "Counter-Strike 2," "Palworld," and "Assassin's Creed Black Flag Resynced." "The Mound: Omen of Cthulhu," released on July 15, received nearly 1,500 "mostly positive" reviews.

Tech Optimizer

July 25, 2026

Scrappy RAT Malware Targets Chrome And Edge Users

A new remote access trojan (RAT) named msaRAT has been identified by Cisco Talos, linked to the Chaos ransomware group and built using Rust. It exploits Chrome and Edge browsers to disguise its traffic and evade detection. MsaRAT operates through a headless browser process, enabling remote code execution and facilitating ransomware deployment, data theft, and other malicious activities. It is typically installed via phishing emails or malicious files, making it resistant to standard browser patches. Cisco Talos recommends specific SNORT rules and a ClamAV signature for detection. Indicators of Compromise (IoC) include traffic to the IP address 172.86.126.18 and the domain is-01-ast.ols-img-12.workers.dev. The malware primarily targets large organizations, but individual users may also be at risk.