Telegram and Steam: This new 'laughing rat' malware will steal your data and hack your systems — and then laugh at you while doing it

New CrystalX RAT Malware-as-a-Service Targets Novice Hackers with Advanced Espionage and Prankware Features

Cybersecurity researchers at Kaspersky have uncovered CrystalX RAT, a sophisticated malware-as-a-service (MaaS) offering that combines remote access, data theft, and prankware capabilities to appeal to novice hackers. Promoted aggressively via Telegram and YouTube, the tool is designed to attract "script kiddies" while posing a serious threat to victims.

Key Capabilities

CrystalX RAT provides attackers with a comprehensive suite of malicious tools, including:

• Remote control & espionage: Command execution, file system access, real-time machine control, and forced shutdowns.
• Data theft: Keylogging, clipboard hijacking, browser data extraction, and theft from apps like Steam, Discord, and Telegram.
• Surveillance: Video and audio capture via webcam and microphone.
• Prankware features: Desktop wallpaper changes, display rotation, fake notifications, cursor manipulation, and disabling critical system tools (Task Manager, Command Prompt).
• Attacker-victim chat: A built-in window for taunting, threatening, or extorting victims.

Promotion & Subscription Model

The malware is marketed through Telegram and a dedicated YouTube channel, demonstrating its features to potential buyers. While pricing details remain undisclosed, CrystalX RAT operates on a tiered subscription model, with anti-analysis protections like geoblocking, anti-debugging, and VM detection to evade detection.

Targets & Impact

Currently, dozens of victims primarily in Russia have been affected, likely through social engineering tactics such as fake software cracks or activators. Kaspersky warns that the malware’s 360-degree compromise could lead to account takeovers, blackmail, and further cybercrime, with expectations of growing victim numbers and expanded geographic reach.

Designed to stand out in the crowded MaaS market, CrystalX RAT’s blend of advanced espionage and disruptive prank features makes it a notable emerging threat.

Source: https://www.techradar.com/pro/security/this-new-laughing-rat-malware-will-steal-your-data-and-hack-your-systems-and-then-laugh-at-you-while-doing-it

SteamChain.io cybersecurity rating report: https://www.rankiteo.com/company/steamchain

Telegram cybersecurity rating report: https://www.rankiteo.com/company/telegram

"id": "STETEL1775175839",
"linkid": "steamchain, telegram",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Dozens', 'location': 'Russia'}],
 'attack_vector': ['Social engineering', 'Fake software cracks', 'Activators'],
 'data_breach': {'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Keylogging data',
                                              'Clipboard data',
                                              'Browser data',
                                              'Steam/Discord/Telegram app data',
                                              'Video/audio recordings']},
 'description': 'Cybersecurity researchers at Kaspersky have uncovered '
                'CrystalX RAT, a sophisticated malware-as-a-service (MaaS) '
                'offering that combines remote access, data theft, and '
                'prankware capabilities to appeal to novice hackers. Promoted '
                'aggressively via Telegram and YouTube, the tool is designed '
                "to attract 'script kiddies' while posing a serious threat to "
                'victims.',
 'impact': {'data_compromised': ['Keylogging data',
                                 'Clipboard data',
                                 'Browser data',
                                 'Steam/Discord/Telegram app data'],
            'identity_theft_risk': 'High',
            'operational_impact': ['Forced shutdowns',
                                   'Disabling system tools (Task Manager, '
                                   'Command Prompt)']},
 'investigation_status': 'Ongoing',
 'motivation': ['Espionage', 'Data theft', 'Prankware', 'Extortion'],
 'post_incident_analysis': {'root_causes': ['Malware-as-a-Service (MaaS) '
                                            'targeting novice hackers',
                                            'Social engineering tactics']},
 'references': [{'source': 'Kaspersky'}],
 'response': {'third_party_assistance': 'Kaspersky'},
 'title': 'New CrystalX RAT Malware-as-a-Service Targets Novice Hackers with '
          'Advanced Espionage and Prankware Features',
 'type': 'Malware-as-a-Service (MaaS)'}