Extremely dangerous malware spreading via YouTube: it comes with a password stealer

These RATs are not after crumbs. They're here for your passwords, crypto, and total control of your systems.

If your system starts acting weird or if your crypto wallet mysteriously drains, you might want to ask Neptune if it’s been visiting.

Neptune RAT (Remote Access Trojan) is the latest nasty piece of code floating around the internet. It hijacks Windows devices, steals credentials, and does it all quietly without being noticed by security tools.

CYFIRMA security researchers have traced the latest version of the threat, which has been spread on social platforms such as GitHub, Telegram, and YouTube.

It's marketed with lines like “Most Advanced RAT” drawing in individuals who might be new to cybercrime or want to test their skills without creating malware from scratch.

While the distributor claims that the malware is “for educational and ethical purposes,” this new RAT is a security nightmare.

What does Neptune RAT do to your Windows system?

Neptune malware is packed with some seriously dangerous features. It includes a crypto clipper, which swaps out cryptocurrency wallet addresses with the hacker’s own, sending your funds straight into their pocket.

It also comes with a password stealer, capable of extracting credentials from over 270 apps, popular browsers including Chrome, and system vaults giving attackers access to everything from your social accounts to banking info.

Then there's the ransomware feature, which locks victim’s files and demands a ransom for the key to unlock them. Not to forget the ability to disable antivirus software, which makes sure Defender and your AV are dead on arrival.

To top it off, it lets hackers monitor your screen in real time, turning your device into an open window for them to spy on whatever you're doing. To make matters worse, the malware can completely wreck your system with a destruction feature if the attacker decides to take that route.

Who’s behind this?

The developer, who openly identifies as a malware creator is allegedly based in Saudi Arabia but was born in Moscow. On Discord, they talk about being part of the "Mason Team" and share their malware development activities.

The developer posts malware demos on YouTube, making it clear that this is someone actively involved in the malicious software development. Their GitHub offers a free version of the builder but hints that a more badass version is behind a paywall.

If you look in the “About” section on their GitHub page, you'll see that Neptune RAT is linked to a group called Freemasonry, along with other names like ABOLHB and Rino.