Loading story…
Trend Micro reported on BIOPASS RAT, a remote-access trojan that abuses legitimate live-streaming platforms to hide its command-and-control activity and evade detection. The malware was observed using compromised hosts to retrieve attacker instructions through content embedded in live-stream channels, allowing operators to blend malicious traffic with normal web activity while maintaining persistent access to victim systems.
The campaign highlighted how threat actors are increasingly repurposing trusted online services as covert infrastructure for malware operations. By masking communications behind popular streaming services, BIOPASS RAT reduced the likelihood of network-based blocking and complicated incident response, underscoring the need for defenders to inspect outbound traffic patterns, monitor abuse of legitimate cloud and media platforms, and hunt for RAT behavior beyond traditional domain and IP reputation checks.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing BIOPASS RAT as a newly observed malware family that uses live-streaming platforms as part of its command-and-control activity. The report publicly disclosed technical details of the threat and its behavior.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** delivering remote-access trojans including **NetSupport RAT**, **Agent Tesla**, **Remcos RAT**, and **CastleRAT/NightShadeC2** through obfuscated scripts, phishing lures, and malicious installers. One NetSupport intrusion used Microsoft SafeLinks redirection, intermediary URLs, obfuscated JavaScript, and hidden PowerShell to fetch ZIP payloads via BITS, then launched `client32.exe` from an `%AppData%\aragdrts` folder and established persistence through scheduled tasks, Startup entries, and Registry Run keys. Separate analyses of Agent Tesla and Remcos samples showed BAT, CMD, JavaScript, and PowerShell stages that decoded or decrypted .NET payloads, with Agent Tesla configured for credential theft, keylogging, screen capture, and SMTP-based exfiltration, while Remcos included functions to disable Microsoft Defender and persist by copying its launcher into the Windows Startup path. A later intrusion report showed how these commodity malware chains are being used for **immediate fraud operations** rather than only initial access. In that case, a malicious `CarrierRegistration.msi` delivered **Matanbuchus**, then **NetSupport RAT**, **Remcos RAT**, and finally **CastleRAT**, which was used to harvest browser credentials and proxy the victim’s live browser session into financial-site login attempts from the compromised host. The activity indicates a shift from simple information theft toward **hands-on-keyboard account takeover**, where attackers exploit stolen sessions and local browser context directly to evade fraud controls tied to device, IP, and session reputation.
Jul 7, 2026
Researchers reported that **Cobian RAT**, a freely advertised remote access trojan distributed on underground forums, contained a hidden backdoor planted by its original author. The malware was marketed as a basic `njRAT`-style tool with common surveillance and remote-control features, including keylogging, webcam access, screen capture, and arbitrary code execution on infected systems. Analysis found that an encrypted library inside the Cobian RAT builder allowed the author to silently take over machines infected by downstream operators and even lock those operators out of their own campaigns. The covert component retrieved a command-and-control address from a preset Pastebin page, giving the author centralized control and effectively turning other criminals’ distribution activity into a **crowdsourced botnet-building scheme**.
Aug 15, 2026