Millenium RAT

The operators take known RATs and exploit builders, silently embed a backdoor, and redistribute the tampered files.

In one campaign, victims received a shortcut disguised as a PDF, which triggered PowerShell silently and fetched a decoy document alongside the RAT payload, opening the document in the foreground as cover.

The Y2K Operators rely entirely on deception to get Millenium RAT onto victim machines. Files are disguised as credit card generators, crypto balance checkers, hacking toolkits, cracked software, and gaming utilities.

In one campaign, victims received a shortcut disguised as a PDF, which triggered PowerShell silently and fetched a decoy document alongside the RAT payload.

Persistence is set up by copying the payload into %APPDATA% and adding a registry autorun entry.

Persistence is set up by copying the payload into %APPDATA% and adding a registry autorun entry.

Persistence is set up by copying the payload into %APPDATA% and adding a registry autorun entry.

Persistence is set up by copying the payload into %APPDATA% and adding a registry autorun entry.

The malware also attempts privilege escalation through a standard Windows UAC prompt, counting on the user to approve it.

The data is Base64-encoded and protected with a custom XOR algorithm, with extra random data added to change the file hash and bypass signature-based detection.

Once executed, the RAT loads an encrypted configuration from an embedded file resource.

After infection, the payload blends in using names like svchost.exe, MsEdgeUpdate.exe, and Microsoft Antivirus.exe.

This contains the Telegram bot token, chat ID, persistence settings, and keylogger options.

It can steal browser credentials and cookies

It can steal browser credentials and cookies

It can steal browser credentials and cookies

This contains the Telegram bot token, chat ID, persistence settings, and keylogger options.

It can steal browser credentials and cookies, capture screenshots and webcam images

It can steal browser credentials and cookies, capture screenshots and webcam images, record audio

It can steal browser credentials and cookies, capture screenshots and webcam images

It communicates with operators through the Telegram Bot API, disguising command-and-control traffic as normal web activity

It communicates with operators through the Telegram Bot API, disguising command-and-control traffic as normal web activity

victims received a shortcut disguised as a PDF, which triggered PowerShell silently and fetched a decoy document alongside the RAT payload

It can steal browser credentials and cookies, capture screenshots and webcam images, record audio, log keystrokes, pull Telegram and Discord session data, and encrypt the victim’s files.