Loading story…
Cybercriminals are actively marketing a new remote access trojan (RAT) called Atroposia as a plug-and-play malware-as-a-service (MaaS) platform, enabling even low-skill threat actors to launch sophisticated attacks. Atroposia is available via underground forums for a subscription fee, offering a modular toolkit that includes hidden remote desktop access, credential and cryptocurrency wallet theft, DNS hijacking, clipboard monitoring, and a local vulnerability scanner. The malware communicates with its command-and-control (C2) infrastructure over encrypted channels, employs multiple persistence mechanisms, and can bypass User Account Control (UAC) on Windows systems to escalate privileges. Its user-friendly control panel and plugin builder further lower the technical barrier for cybercriminals, making advanced attack techniques widely accessible.
Researchers at Varonis and other security firms have highlighted Atroposia's role in the growing trend of turnkey criminal toolkits, which also includes platforms like SpamGPT and MatrixPDF. These toolkits bundle discovery, delivery, and evasion features into easy-to-use interfaces, allowing attackers to automate phishing campaigns, weaponize documents, and maintain stealthy, persistent access to compromised systems. Atroposia's affordability and comprehensive feature set make it a significant threat to enterprises, as it enables rapid deployment of complex attacks by a broader range of adversaries.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Varonis researchers publicly documented Atroposia as a modular RAT featuring encrypted command channels, persistence, credential and cryptocurrency theft, DNS hijacking, local vulnerability scanning, and covert hidden RDP access. The research warned that the malware's design lowers the barrier to entry for sophisticated attacks and could see broader adoption.
A new malware-as-a-service offering called Atroposia began being sold on underground forums as a turnkey remote access Trojan. It was advertised with subscription pricing starting at $200 per month and positioned as usable by low-skilled cybercriminals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecsoonline.com
Open sourcevaronis.com
Open sourcebleepingcomputer.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **VectraRAT**, a previously undocumented Windows remote-access trojan sold exclusively as a malware-as-a-service subscription for **$250 per month**. Operated by a developer using the aliases **Vectra** and formerly **Nyxel**, the full-stack platform enables surveillance, credential theft, remote command execution, file transfer, proxying, and privilege escalation on compromised systems. SOCRadar discovered the operation through an exposed directory containing malware samples, server-side components, licenses, and operator logs, then identified more than 10 related servers. Operators delivered VectraRAT through Amadey loader campaigns and ClickFix pages impersonating TurboTax that prompt victims to paste commands into the Windows Run dialog; logs showed 38 genuine sessions in less than a week, with corporate Windows editions—including Enterprise and Windows Server 2025—accounting for 48% of records containing operating-system data.
Sep 16, 2026
Cybersecurity researchers have identified a surge in malware campaigns leveraging the ClickFix social engineering technique to deploy the Amatera Stealer and NetSupport RAT. These campaigns trick users into executing malicious commands through the Windows Run dialog, often under the guise of completing a reCAPTCHA verification on fraudulent phishing pages. The infection chain typically involves the use of `mshta.exe` to launch a PowerShell script, which downloads a .NET payload from a file hosting service. The Amatera Stealer DLL, packed with PureCrypter, is injected into the `MSBuild.exe` process, enabling the malware to harvest sensitive data from crypto-wallets, browsers, messaging apps, FTP clients, and email services. Advanced evasion techniques, such as WoW64 SysCalls and in-memory AMSI patching, are employed to bypass endpoint detection and response (EDR) and antivirus solutions. The Amatera Stealer, considered an evolution of the ACR Stealer, is available as a malware-as-a-service (MaaS) offering, with subscription plans ranging from $199 to $1,499. The campaigns also deploy NetSupport RAT for remote access and further exploitation. Notably, the PowerShell scripts used by Amatera check for the presence of valuable files or domain membership before proceeding, indicating a targeted approach. These findings highlight the increasing sophistication of social engineering and malware delivery tactics, as well as the growing threat posed by MaaS platforms to organizations and individuals alike.
Jul 12, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026