A laughing RAT: CrystalX combines spyware, stealer, and prankware features

Securelist

April 1, 2026 at 6:00 AM

Actively Exploited

Overview

Kaspersky researchers have identified a new Remote Access Trojan (RAT) called CrystalX, which is being distributed as Malware-as-a-Service (MaaS). This malware combines features of spyware, information stealers, and prankware, making it particularly versatile and dangerous. Users can unknowingly download CrystalX, leading to their personal information being stolen or their devices being used for malicious purposes. The presence of prankware adds a unique twist, as it can also be used to annoy or embarrass victims. This incident underscores the evolving nature of cyber threats and the need for users to be vigilant about the software they install and the links they click on.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Users of infected devices, particularly those downloading software from untrusted sources.
Action Required: Users should avoid downloading software from untrusted sources and ensure their security software is up to date.
Timeline: Newly disclosed

Original Article Summary

Kaspersky researchers analyze a new CrystalX RAT distributed as MaaS and featuring extensive spyware, stealer, and prankware capabilities.

Impact

Users of infected devices, particularly those downloading software from untrusted sources.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should avoid downloading software from untrusted sources and ensure their security software is up to date.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Trojan, Kaspersky.

Read Original Article

Related Coverage

Eight in 10 UK Manufacturers Hit by Cyber Incident in a Year

Infosecurity Magazine

A recent report from cybersecurity firm ESET reveals that around 80% of UK manufacturers experienced a cyber incident over the past year, with many suffering financial losses as a result. This alarming statistic underscores the vulnerability of the manufacturing sector to cyber threats, which can range from ransomware attacks to data breaches. The financial impact of these incidents can be significant, affecting not just the companies involved but also their customers and supply chains. As manufacturers increasingly rely on digital technologies, the need for robust cybersecurity measures becomes even more pressing. Companies must prioritize their defenses to protect against these growing risks, as the consequences of inaction can be severe.

Apr 1, 2026

SentinelOne autonomous detection blocks trojaned LiteLLM triggered by Claude Code

Security Affairs

SentinelOne's AI technology successfully thwarted a supply chain attack involving a compromised LiteLLM package, stopping the malicious code within seconds. The incident occurred when a user unknowingly installed the tainted package, which was triggered by the Claude Code tool. SentinelOne's macOS agent detected the malicious process chain and intervened automatically, preventing any further damage. This event illustrates the ongoing risks associated with supply chain vulnerabilities, as attackers often exploit trusted software components to infiltrate systems. Companies using LiteLLM or similar packages should review their security measures to guard against such threats.

Apr 1, 2026

Axios NPM Package Breached in North Korean Supply Chain Attack

SecurityWeek

The Axios NPM package was compromised in a supply chain attack attributed to North Korean hackers. Attackers exploited a long-lived NPM access token to bypass GitHub's OIDC-based CI/CD publishing workflow, allowing them to publish backdoored versions of the package. This incident raises significant concerns for developers and organizations using Axios, as it highlights vulnerabilities in the software supply chain that could lead to broader exploitation. Users of the affected package need to be vigilant and check for any unauthorized versions, as these could introduce malicious code into their applications. The breach underscores the ongoing risks associated with open-source software and the need for stronger security practices in managing access tokens and dependency management.

Apr 1, 2026

Claude Code source code accidentally leaked in NPM package

BleepingComputer

Anthropic has reported an accidental leak of the source code for its closed-source AI model, Claude Code, through an NPM package. The company clarified that while the source code was exposed, there was no breach of customer data or credentials. This incident raises concerns about the protection of proprietary technology, especially since the source code could potentially allow others to replicate or exploit the functionalities of Claude Code. While no immediate risks to users have been identified, the leak highlights the importance of stringent security measures when handling sensitive software components. Companies must remain vigilant to prevent similar incidents in the future.

Apr 1, 2026

Claude AI finds Vim, Emacs RCE bugs that trigger on file open

BleepingComputer

Researchers discovered serious vulnerabilities in the Vim and GNU Emacs text editors that could allow attackers to execute remote code simply by opening a malicious file. This means that users of these popular text editors could be at risk without any interaction beyond opening a file. The vulnerabilities were identified with the help of the Claude AI assistant, which used simple prompts to find the flaws. This is significant as many developers and users rely on these tools for coding and text editing, making a large number of systems potentially vulnerable. Users should be cautious about the files they open and look out for updates from the developers to address these issues.

Mar 31, 2026

Axios NPM Package Compromised in Precision Attack

darkreading

This week, the Axios NPM package, known for its role as a JavaScript HTTP client library, faced a brief compromise that is suspected to be linked to North Korean threat actors. The incident raised alarms among developers and users who rely on this widely used library for web applications. While the exact details of the compromise are still being investigated, it highlights the ongoing risks associated with third-party software dependencies. Users of Axios should stay vigilant and ensure they are using the latest version of the package to mitigate potential vulnerabilities. This incident serves as a reminder for developers to regularly check the integrity of their dependencies and to implement security measures when integrating third-party packages into their projects.

Mar 31, 2026