New CrystalX RAT Malware-as-a-Service Targets Novice Hackers with Advanced Espionage and Prankware Features Cybersecurity researchers at Kaspersky have uncovered CrystalX RAT, a sophisticated malware-as-a-service (MaaS) offering that combines remote access, data theft, and prankware capabilities to appeal to novice hackers. Promoted aggressively via Telegram and YouTube, the tool is designed to attract "script kiddies" while posing a serious threat to victims. ### Key Capabilities CrystalX RAT provides attackers with a comprehensive suite of malicious tools, including: - Remote control & espionage: Command execution, file system access, real-time machine control, and forced shutdowns. - Data theft: Keylogging, clipboard hijacking, browser data extraction, and theft from apps like Steam, Discord, and Telegram. - Surveillance: Video and audio capture via webcam and microphone. - Prankware features: Desktop wallpaper changes, display rotation, fake notifications, cursor manipulation, and disabling critical system tools (Task Manager, Command Prompt). - Attacker-victim chat: A built-in window for taunting, threatening, or extorting victims. ### Promotion & Subscription Model The malware is marketed through Telegram and a dedicated YouTube channel, demonstrating its features to potential buyers. While pricing details remain undisclosed, CrystalX RAT operates on a tiered subscription model, with anti-analysis protections like geoblocking, anti-debugging, and VM detection to evade detection. ### Targets & Impact Currently, dozens of victims primarily in Russia have been affected, likely through social engineering tactics such as fake software cracks or activators. Kaspersky warns that the malware’s 360-degree compromise could lead to account takeovers, blackmail, and further cybercrime, with expectations of growing victim numbers and expanded geographic reach. Designed to stand out in the crowded MaaS market, CrystalX RAT’s blend of advanced espionage and disruptive prank features makes it a notable emerging threat.