New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS
Summary: LevelBlue researchers flagged a Java-based remote access trojan called QuimaRAT that targets Windows, Linux, and macOS, sold as malware-as-a-service for $150 for one month up to $1,200 for lifetime access. The modular RAT loads encrypted plugins from its command-and-control infrastructure, ships with a builder producing JAR, EXE, APP, SH, BAT, and VBS formats, and sets up persistence through Registry Run keys, Scheduled tasks, .desktop autostart entries, crontab reboot tasks, and a macOS LaunchAgent plist file.
Why it matters: A $150 entry price buys an operator remote command execution, credential theft, clipboard manipulation, and webcam surveillance across three operating systems, with a Pastebin-based mechanism to rotate C2 infrastructure without rebuilding the payload. The seller's own claim that 'AV sees nothing unusual' rests on a builder that packages the client in six output formats and a loader that generates stager links behind fake CAPTCHA and software-update pages.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026