{"id":92,"date":"2026-02-27T11:44:58","date_gmt":"2026-02-27T11:44:58","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=92"},"modified":"2026-02-27T11:44:58","modified_gmt":"2026-02-27T11:44:58","slug":"trojanized-gaming-tools-spread-java-based-rat-via-browser-and-chat-platforms","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=92","title":{"rendered":"Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Feb 27, 2026<\/span><\/span>Endpoint Security \/ Windows Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a remote access trojan (RAT).<\/p>\n

\u00abA malicious downloader staged a portable Java runtime and executed a malicious Java archive (JAR) file named jd-gui.jar,\u00bb the Microsoft Threat Intelligence team said<\/a> in a post on X. \u00abThis downloader used PowerShell and living-off-the-land binaries (LOLBins) like cmstp.exe for stealthy execution.\u00bb<\/p>\n

The attack chain is also designed to evade detection by deleting the initial downloader and by configuring Microsoft Defender exclusions for the RAT components.<\/p>\n

Persistence is achieved by means of a scheduled task and Windows startup script named \u00abworld.vbs,\u00bb before the final payload is deployed on the compromised host. The malware, per Microsoft, is a \u00abmulti-purpose malware\u00bb that acts as a loader, runner, downloader, and RAT.<\/p>\n

Once launched, it connects to an external server at \u00ab79.110.49[.]15\u00bb for command-and-control (C2) communications, allowing it to exfiltrate data and deploy additional payloads.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

As ways to defend against the threat, users are advised to audit Microsoft Defender exclusions and scheduled tasks, remove malicious tasks and startup scripts, isolate affected endpoints, and reset credentials for users active on compromised hosts.<\/p>\n

The disclosure comes as BlackFog disclosed details of a new Windows RAT malware family called Steaelite that was first advertised on criminal forums in November 2025 as a \u00abbest Windows RAT\u00bb with \u00abfully undetectable\u00bb (FUD) capabilities. It’s compatible with both Windows 10 and 11.<\/p>\n

Unlike other off-the-shelf RATs sold to criminal actors, Steaelite bundles together data theft and ransomware, packaging them into one web panel, with an Android ransomware module on the way. The panel also incorporates various developer tools to facilitate keylogging, client-to-victim chat, file searching, USB spreading, wallpaper modification, UAC bypass, and clipper functionality.\u00a0<\/p>\n

Other notable features include removing competing malware, disabling Microsoft Defender, or configuring exclusions, and installing persistence methods.<\/p>\n

As for its main capabilities, Steaelite RAT supports remote code execution, file management, live streaming, webcam and microphone access, process management, clipboard monitoring, password theft, installed program enumeration, location tracking, arbitrary file execution, URL opening, DDoS attacks, and VB.NET payload compilation.<\/p>\n

\u00abThe tool gives operators browser-based control over infected Windows machines, covering remote code execution, credential theft, live surveillance, file exfiltration, and ransomware deployment from a single dashboard,\u00bb security researcher Wendy McCague said<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abA single threat actor can browse files, exfiltrate documents, harvest credentials, and deploy ransomware from the same dashboard. This enables complete double extortion from one tool.\u00bb<\/p>\n

In recent weeks, threat hunters have also discovered two new RAT families tracked as DesckVB RAT<\/a> and KazakRAT<\/a> that enable comprehensive remote control over infected hosts and even selectively deploy capabilities post-compromise. According to Ctrl Alt Intel, KazakRAT is suspected to be the work of a suspected state-affiliated cluster targeting Kazakh and Afghan entities as part of a persistent campaign ongoing since at least August 2022.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Feb 27, 2026Endpoint Security \/ Windows Security Threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a…<\/p>\n","protected":false},"author":1,"featured_media":93,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[265,266,260,263,267,264,262,261,259],"class_list":["post-92","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-browser","tag-chat","tag-gaming","tag-javabased","tag-platforms","tag-rat","tag-spread","tag-tools","tag-trojanized"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/92","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=92"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/92\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/93"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=92"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=92"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=92"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}