Loading malware…
VectraRAT is a Windows remote-access trojan offered as a rental-only malware-as-a-service platform for approximately US$250 per month. Marketed by a developer using the handle Vectra, formerly Nyxel, the platform combines a native C++ Windows implant, a Linux control server, a web-based operator panel, and a payload builder. Its components use a proprietary TCP-based command-and-control protocol rather than standard web traffic.
The implant provides hidden desktop access, screen capture, keylogging, remote Command Prompt and PowerShell execution, file transfer, process discovery, and SOCKS5 proxying through compromised hosts. On initial connection, it automatically collects browser credentials, network information, and configuration files that may contain secrets. Clipboard replacement functionality enables cryptocurrency-address hijacking. An optional user account control bypass abuses trusted Windows functionality to obtain high-integrity execution without displaying an elevation prompt. Operators can also redirect installed implants to different command-and-control infrastructure without rebuilding the payload.
Observed distribution includes the Amadey loader and ClickFix fake-verification pages, including TurboTax-themed lures that persuade users to execute attacker-provided commands through the Windows Run dialog. Compromised systems include corporate Windows workstations and servers, and operators have used the platform for hands-on file exfiltration. Corporate Windows editions accounted for 48% of observed victim records containing operating-system information, but no consistent geographic or industry targeting has been established.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
VectraRAT is a rental-only Malware-as-a-Service platform that gives a paying operator full remote control of a Windows host, along with automated credential and file collection on first connection.
VectraRAT is a rental-only Malware-as-a-Service platform that gives a paying operator full remote control of a Windows host, along with automated credential and file collection on first connection.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
An operator distributes VectraRAT through ClickFix lures hosted on domains such as verify-cloud.digital.
Once installed, the implant can ... run Command Prompt or PowerShell.
Once installed, the implant can ... run Command Prompt or PowerShell.
Once installed, the implant can ... run Command Prompt or PowerShell.
The UAC bypass uses undocumented ntdll functions including NtQueryInformationProcess, NtRemoveProcessDebug, NtDuplicateObject, and DbgUiSetThreadDebugObject.
ClickFix [is] the fake CAPTCHA technique that convinces a user to paste and run a command themselves.
“ClickFix pages, where fake verification prompts persuade people to run copied commands on their own devices” and “a fake CAPTCHA or verification page instructs the visitor to open the Run dialog and paste a command.”
ClickFix pages use fake verification prompts that persuade people to run copied commands on their own devices; a fake CAPTCHA or verification page instructs the visitor to open the Run dialog and paste a command.
The final payload is launched through CreateProcessW with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS pointing to the duplicated handle of computerdefaults.exe, inheriting its elevated token.
The tool includes a privilege-escalation option that can raise its access level without displaying a Windows prompt. Its approach abuses trusted Windows processes.
The stub builder customizes PE VERSIONINFO metadata and recalculates the PE checksum through ApplyStubPE.ForceCheckSum and ApplyStubPE.WithAuthenticode from Linux.
Stubs have been distributed with tax-related naming such as TurboTax2026.exe to reduce user suspicion in North American campaigns during tax season.
The final payload is launched through CreateProcessW with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS pointing to the duplicated handle of computerdefaults.exe, inheriting its elevated token.
The UAC bypass configuration is stored encrypted in the PE's RT_RCDATA 1001 resource as JSON, parsed in memory through cJSON at runtime.
Once installed, the implant can ... record keystrokes.
It also collects ... configuration files containing possible API keys or database strings when it first connects.
It also collects browser credentials ... when it first connects.
It also collects browser credentials, network details and configuration files containing possible API keys or database strings when it first connects.
The netstat module of DataCollect captures active network connections as part of initial automated collection.
The implant enumerates processes through a WMI query against Win32_Process.
On first connection the implant transmits operating system, build number, edition, computer name, public IP address, and installed antivirus.
“Researchers recorded 38 genuine victim sessions in less than a week, with evidence of file theft from business systems.”
Once installed, the implant can ... record keystrokes.
The [ImageSender] module captures desktop frames through GDI+, compresses them with LZNT1, and transmits raw RGB data to the hub.
The clipboard module synchronizes victim clipboard content with the panel in real time, with configurable regex replacement rules supporting cryptocurrency address hijacking.
The DataCollect module executes automatically on first connection to the hub, without operator intervention.
The malware gives paying operators a way to ... move traffic through an infected computer.
A SOCKS5 relay turns the compromised host into an egress node, identified internally as 'Slave' in the hub code.
The malware uses a custom TCP-based communication method over a non-standard channel rather than normal web traffic.
“Researchers observed buyers delivering VectraRAT through Amadey and through ClickFix lures” and the implant can “transfer files.”
VectraRAT is a Windows-focused remote access tool ... [that enables operators] to watch victims, steal data, run commands, and move traffic through an infected computer.
The C2 address is updated dynamically through callback.json in %TEMP%, letting the hub overwrite the embedded address without redistributing a binary.
The malware uses a custom TCP-based communication method over a non-standard channel ... Network port TCP 3308 VectraRAT command-and-control protocol.
File transfers are exfiltrated through the same TCP 3308 channel using a staging system with single-use tokens.
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.