new MaaS malware combines spyware, stealer, and remote access


CrystalX RAT: new MaaS malware combines spyware, stealer, and remote access

Pierluigi Paganini
April 03, 2026

CrystalX RAT, a new sophisticated MaaS malware, combines spyware, data theft, and remote access, allowing attackers to monitor victims.

In March 2026, Kaspersky researchers uncovered a Telegram-based campaign promoting a previously unknown malware sold as a MaaS with three subscription tiers. The Trojan offers a wide range of features, including RAT capabilities, data theft, keylogging, clipping, spyware, and even prank functions to annoy users. This unusual mix makes it stand out, and Kaspersky detects it as CrystalX and related malware variants.

First seen in January 2026 as Webcrystal RAT, this malware was promoted in private Telegram groups and later rebranded as CrystalX RAT, expanding to YouTube marketing. The malware includes a control panel with an auto-builder that lets attackers customize features like geoblocking, anti-analysis tools, and file appearance. Payloads are compressed with zlib and encrypted using ChaCha20. It uses anti-debugging techniques such as proxy and MITM checks, VM detection, anti-attach loops, and stealth patches that bypass security functions, making analysis and detection more difficult.

Once executed, it connects to a command-and-control server, gathers system data, and can steal credentials from apps and browsers, though this feature is currently being updated. It also includes keylogging and clipboard hijacking, even injecting malicious browser extensions to swap crypto wallet addresses.

“When launched, the malware establishes a connection to its C2 using a hard‑coded URL over the WebSocket protocol. It performs an initial collection of system information, after which all data is sent in JSON format as plain text. Then the malware executes the stealer function, doing so either once or at predefined intervals depending on the build options.” reads the report published by Kaspersky. “The stealer extracts the victim’s credentials for Steam, Discord, and Telegram from the system. It also gathers data from Chromium‑based browsers using the popular ChromeElevator utility.”

Stolen data is sent to the C2, with dedicated routines for Yandex and Opera. The stealer feature is currently disabled, likely for updates. The RAT includes a keylogger that streams keystrokes in real time and a clipper that can alter clipboard data or inject malicious browser extensions to replace crypto wallet addresses. It also enables full remote access, allowing attackers to run commands, manage files, control the screen via VNC, and capture audio and video.

The malware includes a “Rofl” section with prank features to annoy victims. Attackers can change wallpapers, rotate the screen, swap mouse buttons, disable peripherals, or trigger shutdowns. Other options include hiding icons, disabling system tools, showing fake notifications, and making the cursor move randomly. It also allows sending messages and opening a chat window for direct interaction with the victim.

The researchers pointed out that the initial infection vector remains unclear, but dozens of victims have been affected, mainly in Russia so far. The MaaS has no geographic limits, meaning it could spread globally. Ongoing development and new versions, along with active promotion, suggest CrystalX RAT infections are likely to rise significantly in the near future.

“The sheer variety of available RATs has perpetuated demand, as actors prioritize flexibility of existing malware and its infrastructure.” concludes the report. “Thus, CrystalX RAT represents a highly functional MaaS platform that is not limited to espionage capabilities – spyware, keylogging and remote control – but includes unique stealer and prankware features.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CrystalX RAT)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Do you ever walk past a person on the streets exhibiting mental health issues and wonder what happened to their family? I have a brother—or at least, I used to. I worry about where he is and hope he is safe. He hasn’t taken my call since 2014.

James and his brother as young children playing together before his brother became sick. James is on the right and his brother is on the left.

James and his brother as young children playing together before his brother became sick. James is on the right and his brother is on the left.

When I was 13, I had a very bad day. I was in the back of the car, and what I remember most was the world-crushing sound violently panging off every surface: he was pounding his fists into the steering wheel, and I worried it would break apart. He was screaming at me and my mother, and I remember the web of saliva and tears hanging over his mouth. His eyes were red, and I knew this day would change everything between us. My brother was sick.

Nearly 20 years later, I still have trouble thinking about him. By the time we realized he was mentally ill, he was no longer a minor. The police brought him to a facility for the standard 72-hour hold, where he was diagnosed with paranoid delusional schizophrenia. Concluding he was not a danger to himself or others, they released him.

There was only one problem: at 18, my brother told the facility he was not related to us and that we were imposters. When they let him out, he refused to come home.

My parents sought help and even arranged for medication, but he didn’t take it. Before long, he disappeared.

My brother’s decline and disappearance had nothing to do with the common narratives about drug use or criminal behavior. He was sick. By the time my family discovered his condition, he was already 18 and legally independent from our custody.

The last time he let me visit, I asked about his bed. I remember seeing his dirty mattress on the floor beside broken glass and garbage. I also asked about the laptop my parents had gifted him just a year earlier. He needed the money, he said—and he had maxed out my parents’ credit card.

In secret from my parents, I gave him all the cash I had saved. I just wanted him to be alright.

My parents and I tried texting and calling him; there was no response except the occasional text every few weeks. But weeks turned into months.

Before long, I was graduating from high school. I begged him to come. When I looked in the bleachers, he was nowhere to be seen. I couldn’t help but wonder what I had done wrong.

The last time I heard from him was over the phone in 2014. I tried to tell him about our parents and how much we all missed him. I asked him to be my brother again, but he cut me off, saying he was never my brother. After a pause, he admitted we could be friends. Making the toughest call of my life, I told him he was my brother—and if he ever remembers that, I’ll be there, ready for him to come back.

I’m now 32 years old. I often wonder how different our lives would have been if he had been diagnosed as a minor and received appropriate care. The laws in place do not help families in my situation.

My brother has no social media, and we suspect he traded his phone several years ago. My family has hired private investigators over the years, who have also worked with local police to try to track him down.

One private investigator’s report indicated an artist befriended my brother many years ago. When my mother tried contacting the artist, they said whatever happened between them was best left in the past and declined to respond. My mom had wanted to wish my brother a happy 30th birthday.

My brother grew up in a safe, middle-class home with two parents. He had no history of drug use or criminal record. He loved collecting vintage basketball cards, eating mint chocolate chip ice cream, and listening to Motown music. To my parents, there was no smoking gun indicating he needed help before it was too late.

The next time you think about a person screaming outside on the street, picture their families. We need policies and services that allow families to locate and support their loved ones living with mental illness, and stronger protections to ensure that individuals leaving facilities can transition into stable care. Current laws, including age-based consent rules, the limits of 72-hour holds, and the lack of step-down or supported housing options, leave too many families without resources when a serious diagnosis occurs.

Governments and lawmakers need to do better for people like my brother. As someone who thinks about him every day, I can tell you the burden is too heavy to carry alone.

James Finney-Conlon is a concerned brother and mental health advocate. He can be reached at [email protected].



Source link