Quick Summary
The Webrat malware is targeting infosec enthusiasts and aspiring hackers by disguising itself as proof-of-concept (PoC) exploits for known vulnerabilities. Discovered in October 2025, this malware can steal data from platforms like Telegram and Discord, log keystrokes, and take control of webcams. It is delivered through malicious GitHub repositories that contain password-protected archives, which include executable files that escalate privileges and disable security features.
The Securityish Brief
The Webrat malware campaign began in September 2025 and was identified by Kaspersky researchers in October 2025. This malware is designed to target budding security professionals and hackers by masquerading as PoC exploits for vulnerabilities with high CVSSv3 scores. The attackers have leveraged several vulnerabilities, including CVE-2025-10294, a flaw in the OwnID Passwordless Login plugin for WordPress, and CVE-2025-59295, a heap-based buffer overflow in Internet Explorer. Other notable vulnerabilities exploited include CVE-2025-12595 and CVE-2025-12596, affecting the Tenda AC23 wireless router, and CVE-2025-54897, a Microsoft SharePoint remote code execution vulnerability.
The malicious GitHub repositories contain machine-generated text and offer a Download Exploit ZIP link that leads to a password-protected archive. Inside this archive, an executable file is present that escalates its privileges to administrator level, disables Windows Defender, and fetches the Webrat malware from a hardcoded URL. This delivery method is particularly concerning as it targets individuals who may not be fully aware of the risks associated with downloading and executing such files.
Why This Matters for Your Security
This campaign serves as a reminder that cybersecurity professionals, especially those who are inexperienced, must exercise caution when handling exploits and potentially malicious files. The use of fake PoC exploits is not a new tactic; similar strategies have been employed in the past, such as the RegreSSHion vulnerability incident. In 2023, there were also attempts to distribute VenomRat malware under the guise of a PoC exploit for a WinRAR vulnerability.
Organizations and individuals should be vigilant about the sources from which they download software and exploits. The Webrat malware highlights the importance of analyzing suspicious files in isolated environments, such as virtual machines or sandboxes, to prevent potential damage to systems containing sensitive information. This incident underscores the ongoing risk posed by cybercriminals who exploit the curiosity and ambition of those entering the cybersecurity field.
As the threat landscape continues to evolve, it is crucial for users to remain informed about the tactics employed by attackers. Monitoring for updates on known vulnerabilities and ensuring that security measures are in place can help mitigate the risks associated with such malware campaigns.
Key Takeaways
- Always verify the source of any software or exploit before downloading it.
- Analyze potentially malicious files in isolated environments like virtual machines or sandboxes.
- Keep your security software, such as Windows Defender, updated and running.
- Stay informed about known vulnerabilities and their exploits to recognize potential threats.
- Educate yourself on safe cybersecurity practices to avoid falling victim to malware.
Key Terms & Concepts
- Webrat: In this article, Webrat refers to malware that targets infosec enthusiasts by masquerading as proof-of-concept exploits.
- CVE: CVE stands for Common Vulnerabilities and Exposures, a list of publicly disclosed cybersecurity vulnerabilities.
- PoC exploit: A PoC exploit is a demonstration of a vulnerability that shows how it can be exploited.
- GitHub: GitHub is a platform for version control and collaboration that allows developers to store and manage their code.
- Privilege escalation: Privilege escalation is a technique used by attackers to gain elevated access to resources that are normally protected from the user.
Read the original article here: https://www.helpnetsecurity.com/2025/12/23/fake-poc-exploits-webrat-malware/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
