New Python-Based RAT Disguised as Minecraft App Steals Sensitive User Data

On October 23, 2025, GBHackers reported the discovery of a new Remote Access Trojan (RAT) named "Nursultan Client," which is disguised as a legitimate Minecraft application. Developed in Python, this malware uses the Telegram Bot API for command-and-control operations, allowing attackers to exfiltrate data and maintain access to infected systems. The RAT targets the gaming community, employing social engineering tactics to deceive users into installing it.

Key features include credential theft, system reconnaissance, and surveillance capabilities, such as taking screenshots and accessing webcams. The malware's simplistic design suggests it is aimed at lower-tier threat actors, highlighting the need for organizations to monitor encrypted traffic and educate users on software authenticity.