From cheats to exploits: Webrat spreading via GitHub

Webrat is a backdoor that researchers say is being distributed via GitHub repositories, with Securelist noting the campaign began distributing in October 2024 and had been active since at least September 2024. In the current operation, the malware is presented as exploits and PoCs, with the campaign targeting inexperienced professionals and students in the information security field, alongside gamers and users of pirated software.

The researchers list CVEs used in the bait as CVE-2025-59295 (CVSSv3 8.8), CVE-2025-10294 (CVSSv3 9.8), and CVE-2025-59230 (CVSSv3 7.8), and describe a download flow that includes a password-protected archive containing a decoy, and a primary malicious file named rasmanesc.exe that escalates privileges, disables Windows Defender, and fetches and executes Webrat samples from a hardcoded URL.

The malware family can steal data from cryptocurrency wallets and apps such as Telegram, Discord and Steam, and also performs spyware actions including screen recording, webcam and microphone surveillance, and keylogging. According to Kaspersky, Webrat is detected with a range of verdicts including HEUR:Trojan.Python.Agent[.]gen and other HEUR and PDM indicators. The article, published on 23 December 2025, includes indicators of compromise listing multiple GitHub repositories and the Webrat C2 URL.