Threat Actors Market Stealthy New RAT as Alternative to ScreenConnect FUD

Cybersecurity researchers have identified a RAT marketed as a fully undetectable (FUD) alternative to ScreenConnect, marking a notable shift in malware-as-a-service. The campaign touts the tool’s ability to bypass security warnings from Google Chrome and Windows SmartScreen, a key selling point that targets trust in established remote access solutions. According to underground forum advertisements, evasion is achieved by bundling malware with valid EV certificates, a tactic that enhances visual trust in browsers.

The threat actors have built a comprehensive evasion toolkit, including antibot mechanisms and cloaked landing pages, enabling the malware to present benign content to automated analysers while delivering malicious payloads to real targets. Fileless execution via PowerShell is used to load the payload into memory, reducing disk writes and evading traditional antivirus scans.

The operation also features a remote viewer function for real-time control, alongside professional social engineering such as convincing fake Adobe Acrobat Reader download pages. The report, dated 22 September 2025, notes the sales approach mirrors legitimate software models and highlights increasing brand impersonation in the threat landscape.