kkRAT Exploits Network Protocols to Exfiltrate Clipboard Data

kkRAT is described as a newly discovered malware family that blends Ghost RAT and Big Bad Wolf and is notable for a network communication protocol that compresses data with zlib before applying an XOR-based encryption layer. According to Zscaler ThreatLabz, the campaign has targeted Chinese-speaking users since early May 2025, with initial detections of fake installer pages that mimic popular software and host ZIP archives containing malicious executables.

The threat actor delivers three Remote Access Trojans—ValleyRAT, FatalRAT, and kkRAT—via phishing sites hosted on GitHub Pages, and once active, the malware follows a three-stage loader to deploy a final payload. A key capability is clipboard hijacking to replace cryptocurrency addresses, alongside the deployment of legitimate remote monitoring tools such as Sunlogin and GotoHTTP.

The sample also uses a Bring Your Own Vulnerable Driver (BYOVD) technique to disable antivirus and EDR callbacks, while it enumerates network adapters, disables them to cut off AV/EDR vendor communications, and modifies registry keys to sustain persistence.