Kaspersky Uncovers CrystalX RAT Malware Platform

Kaspersky researchers have uncovered a new malware-as-a-service platform called CrystalX RAT, promoted through Telegram channels and YouTube since January 2026, that combines remote access, data theft, and unusual prank features to target users worldwide.

The malware, first identified in private Telegram groups as Webcrystal RAT before its rebranding, operates on a tiered subscription model accessible to cybercriminals. In a report released this month, Kaspersky's Global Research and Analysis Team detailed how the tool, written in the Go programming language, provides attackers with extensive control over infected devices. Upon execution, CrystalX RAT connects to a command-and-control server via WebSocket protocol using a hardcoded URL. It then collects system information, transmitted in plain-text JSON format, and enables a range of malicious functions.

Core capabilities include remote access trojan features, allowing operators to execute commands, upload or download files, browse the file system, and control the screen through integrated VNC technology. The malware also captures audio via the microphone and video through the camera, facilitating surveillance. A keylogger...