Loading story…
Researchers have identified STX RAT, a newly observed remote access trojan that pairs credential theft with hidden virtual network computing (HVNC) to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized FileZilla installers. Analysis found anti-analysis checks for VirtualBox, VMware, and QEMU, along with a random-delay “jitter exit” and an AMSI ghosting technique that patches a Windows RPC function to reduce detection.
STX RAT communicates with command-and-control infrastructure at 95.216.51.236 using X25519 ECDH and ChaCha20-Poly1305 encryption, then exfiltrates host information, screenshots, and credentials from tools including FileZilla, WinSCP, and Cyberduck. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious WScript and PowerShell activity, apply available YARA detections, and disable VBScript and JScript where operationally possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On April 9, 2026, reporting based on eSentire Threat Response Unit analysis disclosed STX RAT's anti-analysis checks, AMSI-ghosting technique, encrypted C2 communications with 95.216.51.236, credential theft from FileZilla, WinSCP, and Cyberduck, and its hidden virtual network computing module for invisible remote desktop sessions.
A newly identified remote access trojan, STX RAT, was observed in early 2026 targeting organizations. Initial infection chains used a browser-downloaded VBScript that launched JScript, retrieved a TAR archive, and used PowerShell to inject the payload into memory.
Researchers also identified a distinct distribution campaign in which attackers spread STX RAT through trojanized FileZilla installer packages. This expanded the malware's delivery methods beyond script-based initial access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at eSentire disclosed a previously undocumented remote access trojan, **STX RAT**, after it was used in an attempted intrusion against a financial services organization. The malware was delivered through a sophisticated multi-stage chain involving script launchers, encrypted and compressed payloads, privilege escalation, and in-memory PowerShell execution designed to avoid detection. Investigators said the RAT used **XXTEA** encryption, **Zlib** compression, reflective loading, layered string obfuscation, anti-virtualization checks, registry-based autoruns, and **COM hijacking** to establish persistence and frustrate analysis. Once deployed, STX RAT waited for command-and-control instructions and was built to steal data from browsers, FTP clients, and cryptocurrency wallets while minimizing early detection through delayed credential theft and an encrypted C2 protocol. The malware also supported hidden virtual desktop operations, execution of additional payloads, network tunneling, and simulated user input, giving operators broad post-compromise control. eSentire said the targeted environment was contained and urged organizations, particularly in financial services, to strengthen endpoint protections and reduce exposure to script-based initial access methods.
Jun 29, 2026
Security researchers reported two malware campaigns using fake or trojanized software downloads to install remote access trojans with credential theft and persistence features. eSentire identified a previously undocumented **STX RAT** after an attempted intrusion against a finance-sector organization, where a browser-downloaded VBScript launched a multi-stage loader chain using **XXTEA** and **Zlib** unpacking, anti-analysis checks, and several persistence methods. The malware supports **HVNC**, in-memory payload execution, tunneling, screenshots, security-tool inventory, and theft of browser credentials, cookies, Windows Vault data, FTP client secrets, and cryptocurrency wallets. Its command-and-control design uses **X25519 ECDH**, **Ed25519**, **HKDF-SHA256**, and **ChaCha20-Poly1305** over a custom TCP protocol, with infrastructure reachable over both the clear web and **Tor**. A separate investigation by Breakglass Intelligence found a fake software keygen packaged as a malicious WinRAR self-extracting archive that deployed the **Vjw0rm** JavaScript RAT through a four-layer dropper chain. The infection used nested SFX archives, a compiled AutoHotkey loader, parallel payload paths, and three persistence mechanisms, while abusing `upaste[.]me` as a dead-drop service and hiding the RAT as an XML file later renamed to JavaScript for execution. Researchers said the operator appeared to be a Turkish-speaking commodity cybercrime actor relying on reused tooling, deceptive file paths, and bundled legitimate Windows files to evade detection, underscoring how software cracks, keygens, and trojanized installers remain effective delivery vectors for RATs and infostealers.
Jun 29, 2026
Researchers reported two active malware delivery operations centered on **STX RAT**, a remote access trojan aimed at stealing browser credentials, session tokens, and other access from financially valuable victims such as cryptocurrency traders. One campaign used a high-severity **ClickFix** chain built on the brand-squatted domain `lirunex[.]tech`, which impersonated a payment platform, used server-side cloaking to show a Swagger UI clone to non-targets, and silently replaced clipboard content so victims pasted a malicious command instead of an SSL certificate path. The staged execution launched through `conhost --headless` and ended with a cross-platform RAT hidden inside image files.
Jun 29, 2026