FLEXRAT – ChilloutVR Lures, Shared Secrets, and an OPSEC Hangover

Executive Summary

Hexastrike uncovered an undocumented commodity stealer and remote access toolset, which we track as FLEXRAT, distributed through counterfeit game-modification websites. The most prominent lure infrastructure impersonates the ecosystem surrounding ChilloutVR, a legitimate social VR platform, and advertises downloadable mods and plugins purported to extend the game’s functionality.

The campaign relies on search-driven delivery. Lure sites are positioned to capture users searching for terms such as “Ch…