Newly discovered CrystalX RAT malware ‘pranks’ its victims

Cybersecurity researchers have discovered a brand new malware threat called CrystalX RAT, which is making its way around private hacker group chats and forums.

What sets CrystalX RAT apart from other malware?

It’s an all-in-one hacker tool that includes data stealing and spyware capabilities. Furthermore, perhaps just in time for April Fools’ Day, CrystalX RAT also has unique “prankware” capabilities that can mock and troll its victims in real-time.

On April 1, researchers with cybersecurity firm Kaspersky’s Global Research & Analysis Team (GReAT) published a new report on a new malware they recently discovered in March called CrystalX RAT. 

The team found evidence of this new malware dating back to January, and it was being offered within hacker communities as a MaaS, or Malware-as-a-Service, tool. This means that the developers of CrystalX RAT were offering the malware to less tech-savvy bad actors as a paid subscription service.

RAT stands for Remote Access Trojan and is a particularly dangerous type of malware that gives attackers complete remote access to the targeted computer or mobile device.

However, what caught Kaspersky researchers’ eye about CrystalX RAT was its “extensive arsenal of capabilities” when compared to other similar types of malware.

Once a target downloads the CrystalX RAT malware to their device, they have unknowingly provided an attacker with a slew of data-stealing capabilities and spyware functionality. CrystalX RAT includes a stealer, which gathers system information and extracts private credentials from platforms like Telegram, Discord, Steam, and Chromium-based browsers like Google Chrome. In addition, an attacker can remotely monitor and control the infected device.

CrystalX RAT also includes a keylogger, which records every key that the victim types, and a clipper, which modifies a victim’s clipboard. A hacker can utilize a clipper in order to perform actions such as changing a crypto wallet address when a target goes to paste the address.

However, what truly sets CrystalX RAT apart from other malware is its prankware toolset, which can be used to mock and troll the victim from within their device.

According to Kaspersky, CrystalX RAT comes with a panel titled “Rofl,” which includes different methods in which the attacker can remotely prank the target through their infected computer. 

Using CrystalX RAT, a hacker could remotely change a victim’s desktop background to any image they like or rotate their computer screen’s display, for example.

The attacker could also swap the victim’s mouse buttons, disconnect computer peripherals like the monitor or keyboard, or hide desktop icons. CrystalX RAT also provides the capability to completely shutdown or restart an infected device remotely. Furthermore, a victim can receive custom notifications created by the attacker, who can even send messages in a pop-up chat dialog window.

While these may seem like silly pranks, as Kaspersky points out, they add a distressing psychological toll to the target, who is already a victim to an invasive cyberattack.

“Such a diverse feature set effectively enables a 360-degree compromise of the victim and a complete loss of privacy,” said senior security researcher at Kaspersky Leonid Bezvershenko in a statement. “Beyond gaining access to account credentials, the stolen data could potentially be used for blackmail.”

CrystalX RAT is just one of a number of sophisticated malware attacks to pop up over the past few months. Cybersecurity professionals urge users to be cautious when coming across unknown files online and to stick with downloads from official, trusted sources.