New Remote Access Trojans Expand Stealth and Surveillance Capabilities

Threat researchers reported multiple remote access trojan (RAT) developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new Remcos RAT variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries.

Separately, Elastic detailed a ClickFix social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed MIMICRAT (AstarionRAT). The intrusion chain includes a multi-stage PowerShell flow with ETW and AMSI bypass, a Lua-based shellcode loader, and HTTPS C2 on port 443 using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of ransomware deployment or data theft. In parallel mobile-focused reporting, Zimperium described ZeroDayRAT, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.