Loading story…
Researchers have identified STX RAT, a newly observed remote access trojan that pairs credential theft with hidden virtual network computing (HVNC) to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized FileZilla installers. Analysis found anti-analysis checks for VirtualBox, VMware, and QEMU, along with a random-delay “jitter exit” and an AMSI ghosting technique that patches a Windows RPC function to reduce detection.
STX RAT communicates with command-and-control infrastructure at 95.216.51.236 using X25519 ECDH and ChaCha20-Poly1305 encryption, then exfiltrates host information, screenshots, and credentials from tools including FileZilla, WinSCP, and Cyberduck. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious WScript and PowerShell activity, apply available YARA detections, and disable VBScript and JScript where operationally possible.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On April 9, 2026, reporting based on eSentire Threat Response Unit analysis disclosed STX RAT's anti-analysis checks, AMSI-ghosting technique, encrypted C2 communications with 95.216.51.236, credential theft from FileZilla, WinSCP, and Cyberduck, and its hidden virtual network computing module for invisible remote desktop sessions.
A newly identified remote access trojan, STX RAT, was observed in early 2026 targeting organizations. Initial infection chains used a browser-downloaded VBScript that launched JScript, retrieved a TAR archive, and used PowerShell to inject the payload into memory.
Researchers also identified a distinct distribution campaign in which attackers spread STX RAT through trojanized FileZilla installer packages. This expanded the malware's delivery methods beyond script-based initial access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at eSentire disclosed a previously undocumented remote access trojan, **STX RAT**, after it was used in an attempted intrusion against a financial services organization. The malware was delivered through a sophisticated multi-stage chain involving script launchers, encrypted and compressed payloads, privilege escalation, and in-memory PowerShell execution designed to avoid detection. Investigators said the RAT used **XXTEA** encryption, **Zlib** compression, reflective loading, layered string obfuscation, anti-virtualization checks, registry-based autoruns, and **COM hijacking** to establish persistence and frustrate analysis. Once deployed, STX RAT waited for command-and-control instructions and was built to steal data from browsers, FTP clients, and cryptocurrency wallets while minimizing early detection through delayed credential theft and an encrypted C2 protocol. The malware also supported hidden virtual desktop operations, execution of additional payloads, network tunneling, and simulated user input, giving operators broad post-compromise control. eSentire said the targeted environment was contained and urged organizations, particularly in financial services, to strengthen endpoint protections and reduce exposure to script-based initial access methods.
Jun 29, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Security researchers reported two malware campaigns using fake or trojanized software downloads to install remote access trojans with credential theft and persistence features. eSentire identified a previously undocumented **STX RAT** after an attempted intrusion against a finance-sector organization, where a browser-downloaded VBScript launched a multi-stage loader chain using **XXTEA** and **Zlib** unpacking, anti-analysis checks, and several persistence methods. The malware supports **HVNC**, in-memory payload execution, tunneling, screenshots, security-tool inventory, and theft of browser credentials, cookies, Windows Vault data, FTP client secrets, and cryptocurrency wallets. Its command-and-control design uses **X25519 ECDH**, **Ed25519**, **HKDF-SHA256**, and **ChaCha20-Poly1305** over a custom TCP protocol, with infrastructure reachable over both the clear web and **Tor**. A separate investigation by Breakglass Intelligence found a fake software keygen packaged as a malicious WinRAR self-extracting archive that deployed the **Vjw0rm** JavaScript RAT through a four-layer dropper chain. The infection used nested SFX archives, a compiled AutoHotkey loader, parallel payload paths, and three persistence mechanisms, while abusing `upaste[.]me` as a dead-drop service and hiding the RAT as an XML file later renamed to JavaScript for execution. Researchers said the operator appeared to be a Turkish-speaking commodity cybercrime actor relying on reused tooling, deceptive file paths, and bundled legitimate Windows files to evade detection, underscoring how software cracks, keygens, and trojanized installers remain effective delivery vectors for RATs and infostealers.
Jun 29, 2026