WebRAT Malware via GitHub Repositories Claim as Proof-of-concept Exploits to Attack Users

A malware campaign has emerged utilizing GitHub repositories to distribute the WebRAT malware, masquerading as proof-of-concept exploits and gaming utilities.

Target Audience and Distribution Channels

The malware primarily targets users searching for game cheats, pirated software, and application patches, with a focus on popular games such as Rust, Counter-Strike, and Roblox. Distribution channels include GitHub repositories, YouTube video comments, and pirated software websites, posing a threat to both individual gamers and corporate environments.

WebRAT functions as a stealer and remote access tool, capable of extracting login credentials from platforms such as Steam, Discord, Telegram, and cryptocurrency wallets. It includes advanced features like desktop screen monitoring, webcam access, and full computer control. These capabilities enable attackers to gather personal information, monitor activities in real time, and deploy additional malicious payloads.

The data collected by WebRAT can be exploited for account takeovers, financial theft, blackmail, and swatting attacks. The malware was identified by solar analysts during research into dark web activities, with initial versions appearing in January 2025. It is currently being sold to cybercriminals through closed channels.

The malware distribution strategy relies heavily on social engineering, with attackers posting fake tutorial videos and download links to malicious archives. This extends the risk beyond individual gamers to corporate employees who may inadvertently download pirated software on company devices.

Once installed, WebRAT can compromise sensitive corporate information, including office communications and confidential business data. Its remote control capabilities allow attackers to navigate through corporate networks, potentially leading to significant security breaches.

WebRAT spreads through social engineering campaigns that exploit user trust in open-source platforms like GitHub. Attackers create repositories that appear to host legitimate proof-of-concept exploits, game cheats, or utility programs.

These repositories often feature detailed documentation and fake reviews to enhance credibility. On YouTube, threat actors upload instructional videos demonstrating the fake tools, with download links included in the comments section.

Upon downloading and executing these files, the malware installs silently and establishes persistence on the victim’s system, exfiltrating data to command-and-control servers.

Security teams can detect WebRAT activity using Indicators of Compromise provided by Solar 4RAYS, which include server addresses and network signatures associated with the malware's communication channels.

Based on reporting by Cyber Security News.