Hackers Use Neptune RAT to Spy, Steal, and Wipe Victim Computers

A dangerous new version of Neptune RAT, a powerful Remote Access Trojan (RAT), has been discovered by cybersecurity researchers at CYFIRMA. This malware can steal passwords, hijack cryptocurrency transactions, spy on victims in real time, and even destroy Windows systems.

The malware is being spread on GitHub, Telegram, and YouTube, often advertised as the “Most Advanced RAT.” Attackers use PowerShell commands to download and execute the malware.

Attackers use a harmful script located on catbox.moe to perform silent downloads and executions. The victim’s AppData folder receives Neptune RAT installation which establishes remote server connections that give attackers complete control of infected machines.

The Neptune RAT poses a significant threat because it includes a range of capabilities. It’s able to steal passwords and extract login information from over 270 applications — including popular web browsers like Chrome, Opera, and Brave.

It also functions as a crypto clipper, replacing copied cryptocurrency wallet addresses with the attacker’s own to hijack transactions. In more extreme cases, it operates as ransomware, encrypting files and demanding Bitcoin payments for their release.

The malware can even monitor the victim’s screen in real time, and in severe attacks, it can corrupt the Master Boot Record (MBR), making the system unbootable. It also disables antivirus software upon installation to avoid detection.

Neptune RAT remains hidden through code obfuscation methods. These include Arabic text and emojis, which makes it harder for researchers to analyze its programming. Additionally, the malware includes anti-virtual machine protection, which activates shutdown procedures when it detects analysis activities.

According to CYFIRMA, malware’s creator, who goes by the name “Mason Team,” has uploaded demonstrations on YouTube and offers a free version of Neptune RAT on GitHub. The research reports that the developer claims to be a Moscow-born coder currently residing in Saudi Arabia, with public Discord and YouTube activity linked to the malware’s development.