Loading story…
Attackers ran a large-scale cryptocurrency theft campaign built around ElectroRAT, a custom Golang remote access trojan hidden inside trojanized apps branded as Jamm, eTrade, and DaoPoker. The malware was distributed through dedicated websites, fake company fronts, forum accounts, social media personas, and paid promotion, targeting users on Windows, Linux, and macOS. Researchers said the operation had been active since at least January 2020 and likely reached thousands of victims, based in part on roughly 6,500 unique visitors to Pastebin pages used to retrieve command-and-control details.
Once installed, ElectroRAT ran covertly in the background as mdworker and gave operators broad surveillance and theft capabilities, including keylogging, screenshot capture, file upload and download, and remote command execution. The campaign’s infrastructure also showed ties to Amadey and the KPOT stealer, suggesting overlap with established criminal tooling, while the custom malware itself reportedly evaded antivirus detection for nearly a year. The operation highlights how convincing crypto-themed brands and cross-platform Electron applications were used to lure investors into installing malware that enabled wallet compromise and broader system access.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers identified the first relevant Pastebin pages used by ElectroRAT to retrieve command-and-control IP addresses as having been posted by the user "Execmac." This indicates the cryptocurrency-targeting malware operation was active by that time.
The ElectroRAT malware campaign was discovered in December, according to the research summary. The operation involved trojanized cryptocurrency applications for Windows, Linux, and macOS distributed through fake companies, websites, forum accounts, and social media personas.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **BitRAT** distribution campaigns that used highly tailored social-engineering lures to infect Windows users with the commodity remote access trojan. In one campaign, attackers abused a Colombian cooperative bank’s compromised infrastructure and reused stolen customer records in malicious Excel files, indicating a real breach involving roughly **418,777** rows of sensitive data. Qualys said the operators likely exploited **SQL injection** with `sqlmap`, then used obfuscated macros, `certutil`, and `rundll32` to stage and launch BitRAT from payloads hosted on a throwaway GitHub repository. Separate reporting showed BitRAT also spread through fake **Windows 10 activators** shared on South Korean webhards, Discord, and social media, where a bogus activation tool downloaded the malware and attempted to weaken Windows Defender protections. Fortinet documented another BitRAT campaign that targeted **NFT enthusiasts**, using Hebrew-language Excel lures and Discord-hosted payloads to deliver the malware through batch scripts, PowerShell, and DLL injection into a copied `MSBuild.exe` process. Across the campaigns, BitRAT was described as a low-cost malware-as-a-service tool sold on underground forums since 2021, with capabilities including credential theft, keylogging, webcam and microphone access, hidden remote desktop (**HVNC**), file exfiltration, cryptocurrency mining, DDoS activity, and persistence via startup-folder placement or process injection. The reporting highlights how BitRAT operators increasingly combine stolen data, topical themes, and pirated software bait with legitimate services such as GitHub and Discord to improve infection success.
Aug 15, 2026
Threat actors have used **Parallax RAT**, a low-cost remote access Trojan sold on criminal forums, in phishing and spam campaigns that compromise Windows systems and increasingly target cryptocurrency organizations. Delivery has relied on malicious Microsoft Word attachments, embedded macros, and exploits such as `CVE-2017-11882`, giving attackers full remote access for credential theft, file theft, clipboard monitoring, keylogging, command execution, and broader system control. Researchers reported that the malware has been active since late 2019 and has remained a common payload because of its low price and ease of deployment. Technical analyses show Parallax RAT using multi-stage loaders, process hollowing, and persistence mechanisms including the Windows Startup folder and scheduled tasks. Recent samples decrypted payloads with **RC4**, injected into legitimate processes including `pipanel.exe`, `Notepad.exe`, `mstsc.exe`, and `cmd.exe`, and fetched additional components from services such as **Pastebin** and **Imgur**, while some command-and-control infrastructure used **DuckDNS**. Investigators also observed attacker interaction through Windows Notepad, victim instructions pointing to a Telegram channel, and cleanup scripts designed to delete payloads and remove traces after execution.
Aug 14, 2026
Threat researchers reported several unrelated **RAT-focused malware campaigns** using different delivery channels and evasion techniques. **DEAD#VAX** was described as a Windows phishing operation that delivers **AsyncRAT** via purchase-order lures, abusing **IPFS-hosted VHD** files disguised as PDFs; the mounted VHD drops a multi-stage chain using **WSF**, heavily obfuscated batch scripts, and PowerShell loaders to decrypt and execute x64 shellcode **in memory** by injecting into trusted Windows processes, minimizing on-disk artifacts. Separately, analysis of **Pulsar RAT** activity described persistence via the per-user Run key (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`), an obfuscated batch dropper in *AppData*, PowerShell-based staging, and **Donut-generated shellcode** injection into processes such as `explorer.exe`, with anti-analysis features and data theft (credentials, wallets, tokens) exfiltrated via **Discord webhooks**. On Android, two distinct campaigns were highlighted. **Anatsa** banking malware was found distributed through **Google Play** in a trojanized “document reader” app that exceeded **50,000 downloads** before detection; the initial app acts as a loader that retrieves the full banking trojan and supports credential theft and C2-driven actions, with reporting attributing discovery and tracking to **Zscaler ThreatLabz**. **Arsink RAT** was reported spreading primarily via **Telegram/Discord** and file-sharing sites (e.g., MediaFire) through fake “mod/pro” apps impersonating major brands; research attributed to **Zimperium** cited **~45,000** victim IPs across **143 countries**, **1,216** malicious APKs, and **317** Firebase Realtime Database C2 endpoints, with capabilities including SMS/OTP theft, call log and contact harvesting, location tracking, and microphone audio capture.
Jun 29, 2026