Commercial Malware and RAT Ecosystem Expands with New Infostealers and Mobile/Windows Remote Control Tools

Multiple reports highlight continued growth in commercially sold malware—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a phishing-led Agent Tesla delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., .jse) to execute largely in-memory, leveraging techniques such as process hollowing and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials.

Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed DarkCloud, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., MSVBVM60.DLL) to complicate modern detection. Certo reported Oblivion, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and hidden remote control (HVNC/VNC-like) functionality alongside SMS/2FA interception and device takeover features. BlackFog reported Steaelite, a Windows RAT marketed to enable double extortion by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that malspam-delivered password stealers remain prevalent, with Agent Tesla, FormBook, and Remcos among the most common families observed in email campaigns.