ChocoPoC RAT: A New Threat Targeting Vulnerability Researchers
ChocoPoC is a remote access trojan that hides in Python dependencies of fake PoC exploit repositories on GitHub. It steals credentials, cookies,…
Tag: RAT
WebRAT: Trojan Distributed via Fake CVE PoCs
WebRAT is a trojan that was pushed via fake CVE PoCs in late 2025, primarily targeting students and junior testers, as mentioned…
TinyRCT: New Custom Backdoor Used by CL-STA-1062
TinyRCT is a previously undocumented .NET backdoor discovered by Palo Alto Networks Unit 42. It is a lightweight remote access trojan capable…
DEV#POPPER RAT: Remote Access Trojan in PolinRider Campaign
A remote access trojan delivered as a second-stage payload in the PolinRider campaign. Unpacked from encrypted payloads fetched via blockchain services like…
OtterCookie: Cross-Platform Malware for Data Theft and Remote Access
A modular malware first emerged in September 2024, capable of stealing browser credentials, cryptocurrency wallet data, files, clipboard content, and providing remote…
Cabbage RAT: PowerShell-Based Remote Access Trojan
Cabbage RAT, also known as CageyChameleon, is a PowerShell-based remote access trojan used by North Korean threat actors for credential and data…
NarwhalRAT – Python-Based Remote Access Trojan by ScarCruft
NarwhalRAT is a Python-based remote access trojan (RAT) used by the North Korean group ScarCruft. It is capable of keylogging, screen capture,…
BabaDeda Loader: A Stealthy Malware Loader Targeting Education and Finance
BabaDeda Loader is a malware loader first documented by Morphisec in November 2021. It uses ClickFix social engineering to deliver payloads like…
EtherRAT: A Remote Access Trojan Delivered via Potemkin Loader
EtherRAT is a remote access trojan (RAT) delivered via the Potemkin loader in ClickFix campaigns. It is used alongside RMMProject for credential…
SectopRAT (ArechClient): Remote Access Trojan Delivered via BabaDeda Loader
SectopRAT, also known as ArechClient, is a remote access trojan delivered via BabaDeda Loader. It is deployed using DLL side-loading and provides…