Zimperium found RedWing, an Android bank-fraud operation rented out on Telegram as a finished product, complete with subscription tiers, guides, and a bot that builds each buyer a custom malicious app on demand, so no coding skill is needed. It spreads through phishing links leading to fake app-store pages that convincingly imitate Google Play and other stores. Once installed and granted permissions, it overlays fake login screens on real banking and crypto apps, reads incoming texts and screen content to capture one-time codes, and can silently forward the victim's calls to defeat phone-based verification. It also offers live screen control, keylogging, and camera access.
LevelBlue detailed QuimaRAT, a new Java-based remote access trojan sold as a service that runs across Windows, Linux, and macOS from the same codebase. Subscriptions range from about $150 for a month to $1,200 for lifetime access, lowering the bar for attackers to get cross-platform reach. Built around a modular design, it expands its capabilities through encrypted plugins that operators can load, update, or remove from their command server on the fly. It also uses several obfuscation techniques to keep changing how it looks to security tools without altering its behavior, so signatures based on its appearance are likely to go stale quickly.
McAfee has detailed WeedHack, a malware-as-a-service infostealer campaign that has infected more than 116,000 systems since January by targeting Minecraft players. The malware spreads through malicious Minecraft mods, clients, cheats, and utilities promoted via YouTube videos (some with voice-over narration and thousands of views) and SEO poisoning of keywords matching popular clients like Meteor, Wurst, LiquidBounce, and Impact. WeedHack averages 2,000-3,000 infections daily, mostly in the US, Germany, India, and the UK, across 240+ distribution URLs and 3,820 unique malicious JAR files. It offers customers a dashboard to view stolen credentials and victim data. Some fake sites even link to legitimate GitHub repos to fabricate credibility.
Flare published a deep profile of REMUS, the 64-bit infostealer that emerged in early 2026 after Lumma Stealer's core operators were doxxed in late 2025. Gen Threat Labs links REMUS directly to Lumma's codebase through 'Tenzor' transitional builds from September 2025, identical string obfuscation, anti-VM checks via cpuid leaf 0x40000000, and a refined Application-Bound Encryption bypass for Chromium browsers. The malware harvests browser passwords, cookies, autofill, crypto wallets, and clipboard data, and uses EtherHiding (blockchain-based C2 resolution) for resilience. Flare's 128-post analysis of REMUS forum activity from Feb 12 to May 8 shows the operation has moved from rapid feature expansion into platform stabilization, with active customer-facing MaaS development.
Kaspersky researchers uncovered CrystalRAT, a new malware-as-a-service sold via Telegram and promoted on YouTube with a tiered subscription model. Built in Go, it combines remote access via VNC, keylogging, clipboard hijacking for crypto wallet theft, browser credential stealing from Chromium/Yandex/Opera, and data harvesting from Steam, Discord, and Telegram. Each buyer gets a uniquely encrypted build using ChaCha20, making detection harder. Kaspersky warns that new versions are still shipping, and the victim count is likely to grow.
TrustStrike Labs