Topic
Malware that gives attackers interactive remote control over a compromised device, often used for spying, data theft, or further compromise.
Group-IB found a public reference to a KGB RAT server at version 0.1 from January 2022, years before the trojan went on sale from $150 a month. Group-IB says the "administration tool" pitch covers a surveillance and control toolkit.
Reality
Netskope reports XWorm's plugin count rose from 35 in July 2025 to 46 in October 2026, adding GPS, microphone and browser-session plugins. Netskope says one of them hijacks logged-in sessions and bypasses MFA entirely.
Reality
TrendAI has tied ASHVEIN, a previously undocumented .NET RAT, to UAC-0099 attacks on Ukrainian government personnel, citing five builds from October 2025. The group has fielded newer tools since, so detection that lasts has to target how it delivers and tasks its implants.
Reality
Acronis says the operator borrowed a security vendor's own uninstall driver to shut down Defender on Cambodian machines, and the loader keeps three further ways to blind an agent if the kernel route fails.
Reality
Kaspersky traced one submitted installer to a modified Chinese wallpaper tool whose signed executable sideloads a malicious libcef.dll, and the same installer switches Windows Defender off before it ever runs.
Perspective Coverage
4 publishersReality
Kaspersky found two cross-platform JavaScript RATs, NodeRabbit and PollCat, reaching engineers in aviation and fintech through fake recruiters, from a group that until now shipped native C, C++ and Go.
Perspective Coverage
4 publishersReality
A Northern California freelance marketplace's own messaging system carried Excel macro lures to 80,000 of its users across 18 months. Microsoft closed that delivery step in 2022. The same platform lure now shows up in North Korean operations.
Perspective Coverage
6 publishersReality
Malwarebytes found Kothamine, an undocumented Windows RAT hidden in malicious npm packages, that takes its 30-plus commands over Tailscale's tailcat. The encrypted channel leaves no command-and-control domain to block, pushing detection onto the endpoint.
Reality
Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.
Reality
Huntress found the same one-megabyte PIF in two customer environments, pulled down by a link that promised a PNG. Everything after it is the 2024 DarkMe chain, down to the rundll32 /sta GUID from that campaign.
Reality
The Windows implant, its Linux control server, the protocol between them and the licensing all came from one author, sold at $250 a month. SOCRadar puts the operator's undetected run at nearly four years.
Reality
Zscaler's ThreatLabz found SloppyRAT in June 2026 at the end of a ClickFix chain whose live hosts are all ordinary domains, with a Polygon JSON-RPC lookup held in reserve for when those domains stop answering.
Reality
Huntress took apart an ISO sold as a leaked pre-release copy and found two RATs, a Discord-webhook infostealer and a Chaos build that overwrites anything above 200MB. All of it is old enough for Defender to catch.
Reality
SOCRadar says two previously unreported RATs pull their next-stage commands out of FTP greetings. It is a first in the wild, and noisier than the web dead drops it replaces.
Reality
SOCRadar says attackers have used FTP server login banners as dead-drop resolvers since early July 2026 to stage two undocumented remote access trojans, E4del and PINHOLE.
Reality