New Malware Mixes Espionage with Pranks

Cybersecurity researchers have identified a new malware-as-a-service (MaaS) called CrystalX RAT, available on the dark web. This sophisticated tool blends advanced espionage functionalities, such as spyware, keylogging, and remote control, with engaging prankware features.

The malware's capabilities include extensive remote access, allowing command execution, file manipulation, and real-time system control. It also facilitates data theft through keylogging, clipboard hijacking, and the exfiltration of browser and desktop application data.

For surveillance, CrystalX RAT can capture video and audio. Its prankware features, designed to attract less experienced users, include altering desktop wallpapers, manipulating cursor positions, and hiding system elements. A chat window allows direct interaction with victims for taunting or extortion.

CrystalX RAT is being actively promoted via organized campaigns on Telegram and YouTube, utilizing a tiered subscription model. The inclusion of prankware is seen as a strategic marketing tactic to differentiate it in the MaaS market.

Kaspersky researchers suggest CrystalX RAT is tailored for novice hackers, incorporating features from WebRAT. It includes advanced tools like geoblocking and anti-analysis capabilities. Victims are predominantly located in Russia, with dozens already affected. The malware poses a severe privacy risk, potentially enabling blackmail and a complete compromise of victim systems.