Tiered CrystalX RAT Bundles Spyware, Stealer, Prankware
Kaspersky found a new MaaS called CrystalX that sells ready-made RAT implants to third-party operators. The service is offered in three subscription tiers and provides a web panel, C2 domains, and sample hashes. The builder creates Go-based binaries with anti-debugging, geoblocking, and many configuration options. Deployed payloads combine a remote access backdoor with a stealer, keylogger, clipboard clipper, and a catalog of prankware features. The operator-facing panel and marketing on Telegram and YouTube let low-skill buyers assemble campaigns quickly.
New CrystalRAT malware adds RAT, stealer and prankware features
A new malware-as-a-service called CrystalRAT is being promoted on Telegram, offering remote access, data theft, keylogging, and clipboard hijacking capabilities.