Python RAT Disguised as Minecraft Client Uses Telegram Bot API for Cross-Platform Command & Control

Researchers from Netskope have uncovered a cross‑platform Python-based Remote Access Trojan (RAT) disguised as a Minecraft client that uses the Telegram Bot API for command and control. According to Netskope, the malware, internally dubbed Nursultan Client, can run on Windows, Linux and Darwin (macOS) and leverages a hardcoded Telegram bot token and attacker user ID, meaning only a specific threat actor can issue commands.

The sample reveals the RAT hides its console window and shows a fake installation progress bar to obscure malicious activity, and apart from data exfiltration and remote control, it targets Discord tokens by scanning local storage and major browsers for token files.

Commands such as /tokens, /info, /screenshot and /camera provide reconnaissance, live captures and theft, with reports labelled in Russian and signed “by fifetka.” Netskope notes the malware’s capabilities extend to adware-like behaviours, including opening URLs or displaying text and images, potentially for phishing, while describing the operation as part of Malware-as-a-Service rather than a sophisticated espionage campaign. according to Netskope.