Loading story…
Researchers reported an active campaign distributing CrystalX, a malware-as-a-service (MaaS) remote access trojan sold through private Telegram channels, a dedicated Telegram presence, YouTube promotion, and a web-based control panel. The service offers subscription tiers and bundles multiple capabilities into one payload, including RAT access, credential theft, keylogging, clipboard hijacking, spyware, browser-based crypto clipping, and stealer functions, alongside unusual prankware commands designed to harass or troll victims. Analysts said the malware appears to have evolved from the earlier Webcrystal RAT, also linked to WebRAT/Salat Stealer through similarities in its Go-based code, control panel, and sales bot infrastructure.
CrystalX includes a configurable builder with geoblocking, anti-analysis, anti-debugging, and stealth patching features intended to evade detection and complicate reverse engineering. Reported defenses include zlib compression, ChaCha20 encryption, VM and debugger checks, proxy-tool detection, and patching of Windows security-related functions such as AmsiScanBuffer, EtwEventWrite, and MiniDumpWriteDump. The malware communicates with command-and-control servers over WebSocket using hard-coded URLs and exfiltrates data in plaintext JSON; observed infrastructure includes webcrystal.lol, webcrystal.sbs, and crystalxrat.top. Infection attempts have so far been observed mainly in Russia, but researchers warned the platform has no built-in regional limits and is under active development, raising the risk of broader global abuse.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-01, public reporting detailed that CrystalX combined remote access, spyware, keylogging, clipboard hijacking, browser crypto-clipping, credential stealing, and unusual prankware functions, alongside anti-analysis, anti-debugging, stealth patching, and WebSocket-based C2 communications.
During March 2026, Kaspersky observed an active campaign using CrystalX RAT, with dozens of victims and infection attempts seen in Russia. Researchers assessed the service had no built-in regional restrictions and could be used more broadly.
By March 2026, the malware operation had rebranded as CrystalX RAT and was being promoted through private Telegram chats, a dedicated Telegram channel, and YouTube as a malware-as-a-service platform sold in subscription tiers.
In January 2026, researchers believe the operation was offering a tool called Webcrystal RAT, which showed similarities to WebRAT or Salat Stealer in its control panel, Go-based codebase, and sales bot infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesecurelist.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two **Telegram-marketed malware-as-a-service (MaaS)** offerings focused on mobile device compromise and surveillance. *ZeroDayRAT* is advertised as a subscription spyware platform claiming full monitoring of **Android and iOS** devices, with infections driven by **smishing** and other social-engineering lures that push victims to malicious links disguised as legitimate apps/updates; delivery chains reportedly use multi-stage redirects, URL shorteners, and in some cases trusted hosting such as *GitHub Pages* to evade reputation-based filtering. Once installed, the operator-facing web panel is advertised to provide extensive monitoring, including device profiling, app-usage timelines, GPS tracking, and remote activation of camera/microphone, plus screen recording and keystroke logging—capabilities consistent with credential theft and broad user surveillance. Separately, Cyble detailed ongoing development of *SURXRAT* (marketed as **SURXRAT V5**) as an Android RAT sold through a structured reseller/partner licensing model that enables affiliates to generate customized builds while the operator retains centralized control. The malware is described as a full-featured surveillance and device-control toolkit that abuses **Android Accessibility** permissions for persistent control and uses **Firebase-backed C2**; code similarities indicate lineage from **ArsinkRAT**. Recent samples were observed conditionally downloading a **large LLM module from Hugging Face**, which researchers assess as experimentation that could enable AI-assisted functionality, deliberate device performance impact, or new monetization approaches alongside established behaviors such as data exfiltration, remote command execution, and ransomware-style device locking.
Jun 29, 2026
Group-IB reported that **SilabRAT** is being sold as a malware-as-a-service remote access trojan on Russian-language darkweb forums, with subscriptions advertised at **$5,000 per month** and linked to the Russian-speaking developer **`o1oo1`**. The malware has been observed in spam and **ClickFix** campaigns, where security tools often identify the packer as **HijackLoader** instead of the underlying payload, helping the RAT evade straightforward detection. Unlike centralized crimeware operations, SilabRAT uses operator-hosted infrastructure, allowing each buyer to run their own command-and-control server and keep victim data under their control. SilabRAT is built for stealthy remote access, account takeover, and cryptocurrency theft. Group-IB said its features include **HiddenVNC**, browser profile cloning, cookie theft, a Chrome **App-Bound Encryption** bypass via **`GoogleChromeElevationService`** COM elevation, **AMSI** bypass, **UAC** bypass through **`ICMLuaUtil`**, persistence with Registry Run keys and Scheduled Tasks, keylogging, clipboard monitoring, remote desktop, payload delivery, and process execution. The malware also targets crypto users by stealing wallet artifacts, attempting wallet password cracking with harvested browser credentials, and supporting crypto-clipping, while planned updates reportedly include customizable Electron injection against applications such as **Ledger Wallet** and **Trezor Suite**.
Aug 11, 2026
Cybersecurity researchers have identified a surge in malware campaigns leveraging the ClickFix social engineering technique to deploy the Amatera Stealer and NetSupport RAT. These campaigns trick users into executing malicious commands through the Windows Run dialog, often under the guise of completing a reCAPTCHA verification on fraudulent phishing pages. The infection chain typically involves the use of `mshta.exe` to launch a PowerShell script, which downloads a .NET payload from a file hosting service. The Amatera Stealer DLL, packed with PureCrypter, is injected into the `MSBuild.exe` process, enabling the malware to harvest sensitive data from crypto-wallets, browsers, messaging apps, FTP clients, and email services. Advanced evasion techniques, such as WoW64 SysCalls and in-memory AMSI patching, are employed to bypass endpoint detection and response (EDR) and antivirus solutions. The Amatera Stealer, considered an evolution of the ACR Stealer, is available as a malware-as-a-service (MaaS) offering, with subscription plans ranging from $199 to $1,499. The campaigns also deploy NetSupport RAT for remote access and further exploitation. Notably, the PowerShell scripts used by Amatera check for the presence of valuable files or domain membership before proceeding, indicating a targeted approach. These findings highlight the increasing sophistication of social engineering and malware delivery tactics, as well as the growing threat posed by MaaS platforms to organizations and individuals alike.
Jul 12, 2026