Quick Summary
WebRAT malware is being spread via GitHub repositories that falsely claim to offer proof-of-concept exploits for vulnerabilities like CVE-2025-59295 and CVE-2025-10294. This malware, which emerged earlier this year, can steal credentials for platforms such as Steam, Discord, and Telegram, as well as cryptocurrency wallet data. Security researchers at Kaspersky discovered 15 repositories involved in this distribution, highlighting the ongoing risk of malware disguised as legitimate exploits.
The Securityish Brief
The WebRAT malware has shifted its distribution method, now leveraging GitHub repositories that purport to provide proof-of-concept exploits for recently disclosed vulnerabilities. This change in tactics was noted by Kaspersky, who identified 15 malicious repositories that claimed to exploit vulnerabilities such as CVE-2025-59295, a heap-based buffer overflow in Windows MSHTML, and CVE-2025-10294, a critical authentication bypass in the OwnID Passwordless Login plugin for WordPress.
WebRAT, which is known for its info-stealing capabilities, can capture sensitive data including credentials for Steam, Discord, and Telegram accounts, as well as cryptocurrency wallet information. The malware has been active since the beginning of the year and previously spread through pirated software and game cheats.
In the recent campaign, the malicious repositories provided detailed descriptions of the supposed exploits, which Kaspersky suspects were generated using artificial intelligence. The repositories included a password-protected ZIP file containing a decoy DLL file, a batch file, and the main dropper named rasmanesc.exe, which executes the malware after elevating privileges and disabling Windows Defender.
While all identified malicious repositories have been removed, the threat remains as attackers can easily create new ones under different names. This tactic of using fake exploits to lure users is not new, as similar strategies have been documented in the past.
Understanding the Risks
For everyday users and organizations, the emergence of WebRAT through these channels underscores the importance of vigilance when downloading software or code from untrusted sources. The potential for credential theft and unauthorized access to sensitive information is significant, especially for those using platforms like Steam and Discord.
Security-conscious individuals should be aware of the signs of such attacks, including unexpected prompts to download files or run scripts from unfamiliar repositories. Running any code from untrusted sources in a controlled environment can help mitigate risks.
As the landscape of cyber threats evolves, users must remain informed about the latest tactics employed by threat actors, such as the use of fake exploits on platforms like GitHub. This awareness can aid in recognizing potential threats before they lead to significant security breaches.
Key Takeaways
- Always verify the source of any software or code before downloading it, especially from platforms like GitHub.
- Run potentially untrusted code in a controlled, isolated environment to prevent malware execution.
- Regularly update your security software to protect against the latest threats like WebRAT.
- Monitor your accounts for unusual activity, especially on platforms known to be targeted by malware.
- Educate yourself and your team about the signs of phishing and malware distribution tactics.
Key Terms & Concepts
- WebRAT: In this article, WebRAT refers to a type of malware that functions as a backdoor with info-stealing capabilities.
- CVE: CVE stands for Common Vulnerabilities and Exposures, a list of publicly disclosed cybersecurity vulnerabilities.
- ZIP file: A ZIP file is a compressed file format that can contain one or more files or folders, often used for easier file sharing.
- Privilege escalation: Privilege escalation is a technique used by attackers to gain elevated access to resources that are normally protected from the user.
Read the original article here: https://www.bleepingcomputer.com/news/security/webrat-malware-spread-via-fake-vulnerability-exploits-on-github/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
