Loading story…
Researchers at eSentire disclosed a previously undocumented remote access trojan, STX RAT, after it was used in an attempted intrusion against a financial services organization. The malware was delivered through a sophisticated multi-stage chain involving script launchers, encrypted and compressed payloads, privilege escalation, and in-memory PowerShell execution designed to avoid detection. Investigators said the RAT used XXTEA encryption, Zlib compression, reflective loading, layered string obfuscation, anti-virtualization checks, registry-based autoruns, and COM hijacking to establish persistence and frustrate analysis.
Once deployed, STX RAT waited for command-and-control instructions and was built to steal data from browsers, FTP clients, and cryptocurrency wallets while minimizing early detection through delayed credential theft and an encrypted C2 protocol. The malware also supported hidden virtual desktop operations, execution of additional payloads, network tunneling, and simulated user input, giving operators broad post-compromise control. eSentire said the targeted environment was contained and urged organizations, particularly in financial services, to strengthen endpoint protections and reduce exposure to script-based initial access methods.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting revealed STX RAT's use of in-memory PowerShell loading, XXTEA encryption, Zlib compression, reflective loading, registry autoruns, COM hijacking, anti-virtualization checks, and encrypted command-and-control communications. Defenders were advised to strengthen endpoint protections and reduce exposure to script-based attack paths.
Following the attempted deployment, eSentire's Threat Response Unit analyzed the intrusion and identified STX RAT as a new remote access trojan with capabilities including credential and wallet theft, hidden virtual desktop operation, payload execution, and network tunneling. The affected system was isolated and the targeted environment was contained while monitoring continued.
In late February 2026, a financial services organization was targeted in an attempted intrusion involving the previously undocumented STX RAT. The malware was delivered through a sophisticated multi-stage script-based chain designed to gain execution and persistence while evading detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcescworld.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified **STX RAT**, a newly observed remote access trojan that pairs credential theft with **hidden virtual network computing (HVNC)** to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized **FileZilla** installers. Analysis found anti-analysis checks for **VirtualBox**, **VMware**, and **QEMU**, along with a random-delay “jitter exit” and an **AMSI ghosting** technique that patches a Windows RPC function to reduce detection. STX RAT communicates with command-and-control infrastructure at `95.216.51.236` using **X25519 ECDH** and **ChaCha20-Poly1305** encryption, then exfiltrates host information, screenshots, and credentials from tools including **FileZilla**, **WinSCP**, and **Cyberduck**. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious **WScript** and **PowerShell** activity, apply available **YARA** detections, and disable **VBScript** and **JScript** where operationally possible.
Jun 29, 2026
Researchers reported two active malware delivery operations centered on **STX RAT**, a remote access trojan aimed at stealing browser credentials, session tokens, and other access from financially valuable victims such as cryptocurrency traders. One campaign used a high-severity **ClickFix** chain built on the brand-squatted domain `lirunex[.]tech`, which impersonated a payment platform, used server-side cloaking to show a Swagger UI clone to non-targets, and silently replaced clipboard content so victims pasted a malicious command instead of an SSL certificate path. The staged execution launched through `conhost --headless` and ended with a cross-platform RAT hidden inside image files.
Jun 29, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026