Technology Miraj Islam October 15, 2026 0 Comments

Experts discover strange new malware that scares users with shocks and screams

KGB RAT is a malware-as-a-service platform that offers remote access, credential theft, and cryptocurrency hijacking capabilities.
The malware includes unusual psychological tactics, such as fake BSODs, startle and scream functions.
Researchers found that multiple operators use the tool, which is marketed as legitimate software despite its criminal capabilities.

Halloween is just around the corner, and cybercriminals are taking advantage of it to give Windows users a good scare (and then some!). After all, few things strike as much fear into the hearts of Windows users as the infamous Blue Screen of Death (BSOD), and a newly analyzed strain of malware is weaponizing that nightmare.

Security researchers Group-IB have published a detailed report on KBG RAT, a recently discovered Remote Access Trojan (RAT). The malware has been advertised for sale on underground forums since late 2025, although researchers found evidence of its infrastructure dating back to January 2022. It is very possible that it was used privately for a while before its developers decided to share it with the community.

KGB RAT

KGB RAT is offered as Malware as a Service (MaaS), Group-IB explained, saying subscriptions start at $150 a month and reach $800 a year. The $150 package provides one month of access, while the $800 package covers the entire year, which equates to approximately $67 per month for the annual subscription.

Boo!

What makes this RAT stand out, however, is not its hacking features, but rather its thriller features. In the report, Group-IB describes them as “a set of psychological harassment features,” including screaming, startling, and forced death blue screen features. “Psychological bullying” may be too harsh a classification for a Halloween scare, but we’d say what Microsoft did with its operating system after Windows 11 could fall into that category.

KGB RAT developers call these features “fun settings,” researchers found, while Group-IB says they’re a sign that the threat actor is “comfortable with weaponizing victim anxiety along with data theft.” We think cryptocurrency theft, data breaches, keylogging, and remote desktop access seem to go hand in hand with anxiety.

The malware is designed to evade detection using obfuscation, a daily-updated encryptor, sandbox detection, and mechanisms to disable (or simply bypass) security protections. It uses a Telegram bot to notify attackers when a new device is infected and ip-api.com to determine where the compromised endpoint is located. Researchers said they identified several operators using the same malware creator, including at least one focused on stealing cryptocurrency from its victims.

Another interesting aspect of KGB RAT is that it is positioning itself as a legitimate tool. Their website includes (fake) customer reviews and claims of having been used by over 10,000 IT professionals. It comes with an educational section and different instructional videos. Ironically, the site returned a “502 Bad Gateway” error when we tried to open it. While it could mean it was shut down, it could also mean a temporary server failure or hosting issues, and it could return in the future.

However, while online, it contained a legal section with disclaimers, warnings and notices encouraging users to make legitimate use of its software, Group-IB found. They also included educational videos on how to install, configure and use the software.