CrystalX RAT: new malware-as-a-service mixes stealer, clipper and prankware

Kaspersky researchers have documented CrystalX RAT (reported elsewhere as CrystalRAT), a new malware-as-a-service sold through Telegram since early 2026. It combines remote access, a credential stealer, a keylogger and a cryptocurrency clipper with a "prank" panel that rotates screens and swaps mouse buttons. The jokes are a sales gimmick. For developers, the risk is a stealer that goes after the browser sessions and chat tokens developers rely on every day.

What happened

On 1 April 2026 Kaspersky's GReAT team published an analysis of CrystalX. According to the report, the malware was first discussed as "Webcrystal RAT" in a private Telegram chat for RAT developers in January 2026, then rebranded. The author promotes it on a Telegram channel and in a YouTube review video, and sells access to the control panel in three subscription tiers. Prices were not published.

Kaspersky notes strong similarities to WebRAT (also known as Salat Stealer): an almost identical web panel, a Go codebase and a similar bot-driven sales flow. It recorded dozens of victims. Infection attempts were seen only in Russia so far, but the service has no regional restrictions, and the initial infection vector is unknown.

Who is affected

• Windows users who run a CrystalX build. Samples are 64-bit Windows executables.
• Users of Chromium-based browsers, Yandex and Opera, whose saved credentials and cookies the stealer targets.
• Steam, Discord and Telegram users, whose sessions are explicitly targeted.
• Anyone who copies crypto wallet addresses, because of the clipper.

What it means for developers and engineering teams

Several of the techniques Kaspersky describes are aimed at the tools developers use every day:

• Browser data theft. For Chromium browsers, CrystalX ships a utility called ChromeElevator, stored base64-encoded and gzipped inside the implant, to pull protected browser data. Yandex and Opera get a separate routine that decrypts data on the victim's machine. Saved browser sessions often include GitHub, cloud consoles and SaaS admin panels, so a stolen cookie can be as useful to an attacker as a password, and MFA does not help once the session exists.
• Clipboard hijacking through the browser. The clipper can rewrite clipboard contents. It can also use the Chrome DevTools Protocol to inject a malicious extension into Chrome or Edge that replaces wallet addresses matching regexes for Bitcoin, Litecoin, Monero, Avalanche, Dogecoin and others.
• Anti-analysis aimed at people like us. The implant looks for proxy settings, Fiddler, Burp Suite, mitmproxy and their certificates, checks for virtual machines and debuggers, and patches AmsiScanBuffer, EtwEventWrite and MiniDumpWriteDump to blind Windows defences.
• Plain-text C2. Implants are packed with zlib and encrypted with ChaCha20 using a hard-coded key and nonce. They then talk to a hard-coded URL over WebSocket and send JSON in plain text, including a live keystroke stream. That makes network detection more realistic than for many stealers.

Kaspersky found the stealer module temporarily disabled in current builds while the author updates it, so expect it back. The full remote access toolkit stays active: file upload and download, cmd.exe command execution, built-in VNC with a button to block the victim's input, and background capture of microphone audio and webcam video. On a developer machine, that means an attacker can watch you type passwords, read your source tree and copy SSH keys.

What to do now

1. Don't run unsigned tools from Telegram, YouTube links or "cracked" downloads on any machine that holds work sessions. Use a separate VM or device for testing untrusted binaries.
2. Keep long-lived sessions out of the browser where you can. Use short session lifetimes for cloud consoles and GitHub, and prefer hardware-backed passkeys so a stolen password alone is useless.
3. Watch for browsers started with remote debugging. Alert on chrome.exe or msedge.exe launched with --remote-debugging-port or --load-extension by anything other than your test tooling.
4. Lock down extensions with enterprise policy (ExtensionInstallAllowlist) on managed machines.
5. Always verify pasted wallet addresses against the source before sending funds.
6. If you suspect infection, wipe and rebuild, then revoke sessions (sign out everywhere) and rotate credentials and tokens from a clean device.

Related on TechLogHub

• Authentication: why session tokens are as sensitive as passwords
• VaultX: an offline password manager

Sources

• Kaspersky Securelist: CrystalX RAT with prankware features (1 April 2026)
• BleepingComputer: New CrystalRAT malware adds RAT, stealer and prankware features
• SC Media: CrystalRAT malware-as-a-service