Loading story…
Zscaler ThreatLabz identified SloppyRAT, a developing Windows remote-access trojan linked to ransomware-related activity. ClickFix social-engineering lures convince victims to run commands that abuse finger.exe to fetch a batch-script downloader, which retrieves IronPython and obfuscated Python stages before deploying CastleLoader, CastleRAT, and a SloppyRAT DLL reflectively loaded into memory.
SloppyRAT supports host reconnaissance, authenticated remote command execution, Microsoft Defender configuration changes, WMI-launched shells, CLR-based or PPID-spoofed PowerShell, and reverse SOCKS proxying to pivot through internal networks before encryption. Its HTTPS JSON command-and-control uses certificate pinning, API-key authentication, and RC4-encrypted telemetry, while runtime decryption, obfuscated strings, junk code, API hashing, and Hell's Gate-style indirect system calls hinder detection; an apparent Polygon-based EtherHiding fallback may provide additional C2 resilience. Its observed Run-key and COM-hijacking persistence mechanisms are flawed, but its operational capabilities can still establish and expand ransomware operators' access.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
In June 2026, Zscaler ThreatLabz identified SloppyRAT, a developing Windows remote-access trojan linked to a ransomware-related actor. The malware was delivered through a multi-stage ClickFix chain abusing finger.exe and ultimately enabled reconnaissance, command execution, reverse-SOCKS pivoting, and lateral movement; its observed Run-key and COM-hijacking persistence attempts were defective.
ThreatLabz disclosed that SloppyRAT uses encrypted runtime-decrypted code, junk code, indirect system calls, certificate pinning, and EtherHiding as a backup command-and-control channel. The report also published infrastructure, staging-location, user-agent, and 22 SHA-256 indicators for detection and investigation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs identified an active ClickFix campaign that compromises legitimate websites, including `bincheck.io` and `investonline.in`, to display multilingual fake Cloudflare verification prompts. The lure copies an obfuscated PowerShell command to a visitor’s clipboard and relies on the victim manually executing it, initiating a five-stage infection chain that delivers the custom native C++ remote-access trojan **MIMICRAT**. The PowerShell stages use runtime obfuscation and attempt to disable Windows Event Tracing for Windows (ETW) logging and AMSI scanning before a Lua-based loader decrypts and runs shellcode in memory. MIMICRAT uses malleable HTTPS command-and-control and enables file and process operations, token theft and impersonation, shellcode injection, interactive shells, and SOCKS5 tunneling; the campaign remained active when reported.
Sep 9, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Researchers and Microsoft documented multiple **ClickFix** intrusion chains that trick users into pasting malicious commands after fake browser errors or security prompts, then abuse native tools and staged scripting environments to deliver malware. In one Windows chain, a caret-obfuscated command entered through the Run dialog used the **finger** protocol over TCP/79 to fetch a batch stage, killed `explorer.exe`, copied and renamed the native `curl.exe`, downloaded the legitimate **IronPython 3.4.2** release from GitHub disguised as a PDF, extracted it with `tar.exe`, and launched an encoded Python payload. That payload decoded layered content, disabled TLS certificate verification, contacted `artides[.]net` for in-memory execution, beaconed to `claudeam[.]com`, and ended with **RemoteLibraryInjection** into `explorer.exe` plus installation of a global low-level keylogger. Microsoft separately described the **CrashFix** variant, which used a fake Chrome extension impersonating **uBlock Origin Lite** to establish foothold, intentionally crashed the browser, and then prompted victims to run commands that renamed `finger.exe` and fetched obfuscated PowerShell. On domain-joined systems, the activity dropped a portable **WinPython** environment and the **ModeloRAT** Python remote access trojan, established persistence through a Run key, and in related cases created a scheduled task named **`SoftwareProtection`** for repeated execution. Additional reporting showed the same broader ClickFix ecosystem targeting **Windows, macOS, and Linux**, including a Perl-based **Pearl Stealer** that harvested browser, wallet, document, and Apple Notes data, stole macOS passwords, and exfiltrated files after OS-specific clipboard-delivered commands downloaded payloads from attacker infrastructure.
Aug 14, 2026