Steaelite
Steaelite is a commercially marketed Windows remote access trojan (RAT) first observed/advertised on underground cybercrime forums in November 2025, promoted as the “best Windows RAT” with claimed “fully undetectable” (FUD) capabilities. It is positioned as an “all-in-one” platform for double-extortion by combining automated data/credential theft and ransomware deployment within a single, browser-based operator control panel.
Behavior and capabilities described include immediate automated harvesting upon initial victim connection (before operator interaction), specifically browser-stored passwords, session cookies, and application tokens. The web dashboard exposes modules for remote code execution (including a browser-based live command prompt), file management (directory traversal and one-click download), process management, clipboard monitoring, password recovery, installed program enumeration, location tracking, URL opening/arbitrary file execution, and DDoS. Surveillance features include live screen streaming plus webcam and microphone access. Additional tooling includes VB.NET payload compilation, persistence installation, Windows Defender disabling/exclusion management, hidden RDP, keylogging, client-to-victim chat, file searching, USB spreading, UAC bypass, wallpaper modification/message box delivery, and a “bot-killing” feature to remove competing malware. It also includes a cryptocurrency clipboard “clipper” that monitors for wallet addresses and replaces them with attacker-controlled addresses prior to paste completion.
Targeting/coverage: advertised as compatible with Windows 10 and Windows 11; an Android module (described as an Android ransomware module) is reportedly “in development.”
Marketing/distribution notes: BlackFog reported repeated forum thread “bumps” and a YouTube promotional video demonstrating capabilities.
Indicators of compromise explicitly listed in the content: C2 domain 1e81ea2a059f.ngrok-free.app (paths /dashboard.html and /victim.html) and a SHA-256 value b2a8d97da2a653de75d3d1be5839 (as provided).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Privilege Escalation
1 technique
Privilege Escalation
Credential Access
5 techniques
Credential Access
Lateral Movement
2 techniques
Lateral Movement
Collection
7 techniques
Collection
Command and Control
2 techniques
Command and Control
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows remote access trojan sold on criminal forums that provides browser-based control of infected hosts and bundles data theft plus ransomware deployment capabilities in a single web panel; supports functions like keylogging, credential theft, surveillance (webcam/mic/live streaming), file exfiltration, UAC bypass, USB spreading, and Defender tampering/exclusions.
Commercially sold Windows remote access trojan with an in-browser operator dashboard that performs automated credential/token/cookie theft on initial connection and provides extensive remote administration and surveillance features (RCE, file/process management, live streaming, webcam/mic, keylogging, clipboard monitoring). It also includes “advanced tools” for ransomware deployment to enable double-extortion (steal then encrypt) and additional capabilities such as hidden RDP, Defender tampering, persistence, USB spreading, UAC bypass, and a crypto-clipper to swap wallet addresses during copy/paste.
Steaelite is a Windows-focused remote access trojan sold on underground forums that provides a browser-based operator panel to automate credential and token theft (passwords, cookies, app tokens) and enable full remote control (RCE, screen streaming/HVNC, webcam/mic, file/process/clipboard control). It also includes modules for persistence, UAC bypass, Windows Defender disabling, DDoS, a cryptocurrency clipboard clipper, and one-click ransomware deployment; an Android ransomware module is reportedly in development.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.