HVNC

SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft

• Malware

SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft

Do Son October 27, 2026 0

Group-IB analyzes over 280 samples of SiriusQT RAT. Discover how the Windows SiriusQT RAT uses HVNC, six persistence methods, and 100+ stealer targets.

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims

• Cybercriminals

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims

Do Son July 23, 2026 0

Varonis Threat Labs analyzed Dolphin X stealer, a forum-sold RAT with 300+ credential targets and an AI Profiler that ranks victims for operators.

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader

• Malware

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader

Do Son June 17, 2026 0

SilabRAT malware, aka SnappyClient, is a $5K/month MaaS RAT flagged as HijackLoader. It uses HVNC and cracks crypto wallets, per Group-IB.

JUMPSEC Unmasks Iranian ‘Muddy Water’ Using Russian ‘CastleRAT’ Malware

• Cyber Security
• Malware

JUMPSEC Unmasks Iranian ‘Muddy Water’ Using Russian ‘CastleRAT’ Malware

Do Son April 15, 2026 0

Iranian state actor Muddy Water adopts CastleRAT and ChainShell to hijack browsers and bypass MFA invisibly. A professional-grade shift in APT strategy.

STX RAT: The New Financial Predator Hiding in the “Start of Text”

• Malware

STX RAT: The New Financial Predator Hiding in the “Start of Text”

Do Son April 13, 2026 0

eSentire TRU uncovers STX RAT, a modular Trojan targeting finance with HVNC, AMSI Ghosting, and advanced encryption. Secure your perimeter—learn how it works.

New FvncBot Android Trojan Targets mBank Users with HVNC and H.264 Screen Streaming

• Malware

New FvncBot Android Trojan Targets mBank Users with HVNC and H.264 Screen Streaming

Do Son December 9, 2025 0

A unique Android banking trojan, FvncBot, targets mBank (Poland) customers. It uses HVNC and H.264 to stream screens and performs web-inject attacks via FCM/WebSocket C2.

GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2

• Malware

GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2

Do Son October 20, 2025 0

Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.

EdskManager RAT: New Stealthy Malware Leverages HVNC for Covert Remote Access & Evasion

• Malware

EdskManager RAT: New Stealthy Malware Leverages HVNC for Covert Remote Access & Evasion

Do Son July 24, 2025 0

CYFIRMA uncovers EdskManager RAT, a sophisticated remote access trojan using HVNC, multi-stage execution, and advanced persistence for covert, long-term system access.