Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.
The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.
The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.
The post Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks appeared first on SecurityWeek.
New ‘Mistic’ RAT Opens Door to Several Ransomware Families
Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
The post New ‘Mistic’ RAT Opens Door to Several Ransomware Families appeared first on SecurityWeek.
Mirax RAT Targeting Android Users in Europe
Offered as a MaaS to a small number of affiliates, mainly Russian speakers, the RAT can turn devices into residential proxy nodes.
The post Mirax RAT Targeting Android Users in Europe appeared first on SecurityWeek.
Fake Claude Website Distributes PlugX RAT
The malware mimics the legitimate Anthropic installation, relies on DLL sideloading, and cleans up after itself.
The post Fake Claude Website Distributes PlugX RAT appeared first on SecurityWeek.
Sophisticated CrystalX RAT Emerges
The malware can spy on victims, steal their information, and make configuration changes on devices.
The post Sophisticated CrystalX RAT Emerges appeared first on SecurityWeek.
Microsoft Warns of ClickFix Attack Abusing DNS Lookups
Attackers are using DNS requests to deliver a RAT named ModeloRAT to targeted users.
The post Microsoft Warns of ClickFix Attack Abusing DNS Lookups appeared first on SecurityWeek.
Hugging Face Abused to Deploy Android RAT
Android users were lured to applications that served a malicious payload hosted in a Hugging Face repository.
The post Hugging Face Abused to Deploy Android RAT appeared first on SecurityWeek.
Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’
Posing as an ad blocker, the malicious extension crashes the browser to lure victims into installing malware.
The post Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ appeared first on SecurityWeek.
