Cybersecurity articles tagged #RAT on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/ftp-banners-abused-to-deliver-e4del-and-pinhole-ratshttps://runtimerebel.com/blog/ftp-banners-abused-to-deliver-e4del-and-pinhole-ratsThreat actors are using FTP server banners to hide commands, delivering new Windows remote access trojans E4del and PINHOLE via LNK-based infection chains.Mon, 24 Aug 2026 08:38:06 GMTRATLNK FilesPhishingE4delPINHOLEhttps://runtimerebel.com/blog/silkparasite-espionage-campaign-targets-central-asian-governmentshttps://runtimerebel.com/blog/silkparasite-espionage-campaign-targets-central-asian-governmentsSilkParasite espionage campaign targets Central Asian governments with seven remote access tools, including five newly documented RAT families.Wed, 19 Aug 2026 16:20:56 GMTEspionageRATMalwareSilkParasiteShadowPadhttps://runtimerebel.com/blog/msarat-chaos-ransomware-s-covert-browser-based-c2https://runtimerebel.com/blog/msarat-chaos-ransomware-s-covert-browser-based-c2Cisco Talos uncovers msaRAT, a new Rust-based RAT used by Chaos ransomware for covert C2 via Chrome DevTools Protocol, evading detection.Sat, 08 Aug 2026 00:57:54 GMTChaos RansomwareRATRustmsaRATChrome DevTools Protocolhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerCritical npm supply chain attack involving nearly 800 malicious packages delivers WEL1DROPPER RAT and infostealer to Windows, macOS, and Linux users.Sat, 08 Aug 2026 00:54:29 GMTNPMSupply Chain AttackInfostealerRATWEL1DROPPERhttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-rathttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-ratBeta versions of @joyfill/layouts and @joyfill/components npm packages compromised to deliver a DEV#POPPER RAT upon import. Node.js users at risk.Wed, 29 Jul 2026 06:32:18 GMTJoyfillNPMSupply Chain AttackRATDEV POPPERNode Jshttps://runtimerebel.com/blog/dolphin-x-malware-ai-driven-target-prioritization-defensehttps://runtimerebel.com/blog/dolphin-x-malware-ai-driven-target-prioritization-defenseAnalysis of Dolphin X, a new RAT utilizing AI to profile and rank victims, enabling threat actors to prioritize high-value targets for data exfiltration and further…Fri, 24 Jul 2026 02:46:46 GMTDolphinXRATAITargetingMalware AnalysisCyber Threathttps://runtimerebel.com/blog/malicious-vite-npm-packages-deliver-rat-via-blockchain-c2https://runtimerebel.com/blog/malicious-vite-npm-packages-deliver-rat-via-blockchain-c2Seven malicious npm packages target Vite frontend projects. Dubbed ViteVenom, this software supply chain attack uses a four-tier blockchain C2 to deploy a RAT.Fri, 17 Jul 2026 20:57:56 GMTViteVenomChainVeilNPMViteSoftware Supply Chain AttackRATBlockchain C2https://runtimerebel.com/blog/labubarat-rust-based-rat-masquerades-as-nvidia-software-on-windowshttps://runtimerebel.com/blog/labubarat-rust-based-rat-masquerades-as-nvidia-software-on-windowsBlackpoint Cyber researchers warn of LabubaRAT, a new Rust-based remote access trojan disguised as NVIDIA software, granting full control over Windows hosts.Tue, 14 Jul 2026 17:20:39 GMTLabubaRATRustNVIDIARATWindowsRemote Access Trojanhttps://runtimerebel.com/blog/modbeacon-rat-silver-fox-uses-grpc-for-stealthy-c2https://runtimerebel.com/blog/modbeacon-rat-silver-fox-uses-grpc-for-stealthy-c2A new Rust-based MODBEACON RAT, linked to the Silver Fox cybercrime group, employs gRPC streaming for encrypted C2, propagated via SEO poisoning.Fri, 10 Jul 2026 14:30:03 GMTMODBEACONRATSilver FoxgRPCC2RustSEO Poisoninghttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-rathttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-ratSecurity researchers uncover malicious npm packages such as postcss-minify-selector-parser delivering Windows RATs via supply chain attacks. Audit your builds.Tue, 23 Jun 2026 13:10:31 GMTNPMPostCSSTyposquattingRATJavaScripthttps://runtimerebel.com/blog/etherrat-exploits-github-facades-to-target-high-privilege-accountshttps://runtimerebel.com/blog/etherrat-exploits-github-facades-to-target-high-privilege-accountsA sophisticated campaign uses GitHub Facades and SEO poisoning to distribute EtherRAT by spoofing administrative utilities and DevOps tools.Thu, 30 Apr 2026 12:40:37 GMTEtherRATGitHub FacadesDevOps SecuritySEO PoisoningRAThttps://runtimerebel.com/blog/dprk-s-contagious-interview-spreads-rats-via-dev-repositorieshttps://runtimerebel.com/blog/dprk-s-contagious-interview-spreads-rats-via-dev-repositoriesDPRK threat actors are employing a 'contagious interview' scam, weaponizing compromised developer repositories to propagate RATs and malware across the software supply…Wed, 22 Apr 2026 20:27:05 GMTDPRKLazarus GroupFake Job ScamRATSoftware Supply ChainSocial EngineeringDeveloper Compromisehttps://runtimerebel.com/blog/ref1695-operation-iso-lures-deploy-rats-and-crypto-minershttps://runtimerebel.com/blog/ref1695-operation-iso-lures-deploy-rats-and-crypto-minersFinancially motivated REF1695 operation uses fake ISO installers to distribute RATs and crypto miners, monetizing infections via cryptojacking and CPA fraud since…Thu, 02 Apr 2026 12:26:05 GMTREF1695Cryptocurrency MiningRATISO FilesCPA FraudFake Installershttps://runtimerebel.com/blog/crystalrat-malware-a-new-maas-threat-with-rat-stealer-and-prankwarehttps://runtimerebel.com/blog/crystalrat-malware-a-new-maas-threat-with-rat-stealer-and-prankwareCrystalRAT is a new malware-as-a-service (MaaS) promoted on Telegram, offering remote access, data theft, keylogging, and system disruption features, posing a…Thu, 02 Apr 2026 00:37:19 GMTCrystalRATMalware as a ServiceRATInformation StealerKeyloggerPrankwareTelegramhttps://runtimerebel.com/blog/axios-supply-chain-attack-rat-found-in-versions-1-14-1-and-0-30-4https://runtimerebel.com/blog/axios-supply-chain-attack-rat-found-in-versions-1-14-1-and-0-30-4Malicious Axios versions 1.14.1 and 0.30.4 inject a cross-platform RAT via a fake dependency. Identify and remediate this npm supply chain threat now.Tue, 31 Mar 2026 08:29:42 GMTAxiosNPM SecuritySupply Chain AttackRATJavascript SecurityMalicious Dependencyhttps://runtimerebel.com/blog/glassworm-malware-uses-solana-dead-drops-for-stealthy-c2-deliveryhttps://runtimerebel.com/blog/glassworm-malware-uses-solana-dead-drops-for-stealthy-c2-deliveryGlassWorm evolves to use Solana blockchain metadata for C2 infrastructure, deploying a RAT and a malicious Google Docs Chrome extension to steal crypto data.Wed, 25 Mar 2026 16:31:31 GMTGlassWormSolanaRATInformation StealerBlockchain Dead Dropshttps://runtimerebel.com/blog/smartapesg-leverages-clickfix-pages-to-deploy-remcos-rathttps://runtimerebel.com/blog/smartapesg-leverages-clickfix-pages-to-deploy-remcos-ratAnalysis of the SmartApeSG campaign, detailing its use of deceptive 'ClickFix' pages to distribute Remcos RAT.Sat, 14 Mar 2026 04:37:52 GMTSmartApeSGRemcos RATClickFixRATPhishinghttps://runtimerebel.com/blog/npm-malware-openclaw-ai-openclawai-macos-credential-theft-alerthttps://runtimerebel.com/blog/npm-malware-openclaw-ai-openclawai-macos-credential-theft-alertSecurity alert for @openclaw-ai/openclawai, a malicious npm package targeting macOS users to deploy remote access trojans and steal sensitive credentials.Mon, 09 Mar 2026 20:11:58 GMTNPMmacOSMalwareRATOpenClawSupply Chain Attackhttps://runtimerebel.com/blog/malicious-laravel-packagist-packages-deploy-cross-platform-rathttps://runtimerebel.com/blog/malicious-laravel-packagist-packages-deploy-cross-platform-ratSecurity researchers discover malicious Laravel packages on Packagist delivering cross-platform RATs to Windows, macOS, and Linux systems. Audit your PHP dependencies.Wed, 04 Mar 2026 12:17:15 GMTPackagistLaravelPHPSupply Chain AttackRATNhattuanbl