kkRAT: A New Malware Blends Crypto Hijacking with Legitimate RMM Tools

Zscaler ThreatLabz has identified kkRAT as a new malware family that blends crypto hijacking with the deployment of legitimate remote‑monitoring and management tools, active since early May 2025 and targeting Chinese‑speaking users alongside other RATs such as ValleyRAT and FatalRAT. According to Zscaler, the campaign uses fake installer pages mimicking popular software to deliver three different RATs as the final payload, with phishing sites hosted on GitHub Pages.

The infection chain involves a multi‑stage process, including environment checks to evade sandboxes, a BYOVD attack via RTCore64.sys to disable AV/EDR callbacks, and a stage where obfuscated shellcode unpacks ZIP archives containing legitimate executables and malicious DLLs for DLL sideloading.

Key features include clipboard hijacking to replace cryptocurrency wallet addresses, and the deployment of legitimate RMM tools such as Sunlogin and GotoHTTP for long‑term access, alongside extensive plugin support for remote desktop control and other capabilities. kkRAT also encrypts its C2 configuration and uses zlib compression with XOR encryption for network traffic, while exfiltrating system information and even messaging apps to the attacker’s command‑and‑control server.