Java-Based RAT Distributed via Trojanized Gaming Tools on Browsers and Chat Apps

Java-Based RAT Spreads Through Trojanized Gaming Utilities

Microsoft Threat Intelligence has identified a malicious campaign in which threat actors are distributing a Java-based remote access trojan (RAT) via trojanized gaming utilities. These compromised tools are being disseminated through browsers and chat platforms, tricking unsuspecting users into executing the payload.

Technical Details of the Attack

According to Microsoft’s findings, the attack chain begins with a malicious downloader that stages a portable Java runtime environment. The downloader then executes a malicious Java archive (JAR) file named jd-gui.jar, leveraging PowerShell to facilitate the infection process.

While Microsoft did not disclose specific indicators of compromise (IoCs) or the exact distribution vectors, the use of Java-based malware and PowerShell suggests a multi-stage attack designed to evade detection and establish persistence on compromised systems.

Impact and Risks

The deployment of a RAT enables threat actors to:

• Gain unauthorized remote access to infected systems
• Exfiltrate sensitive data, including credentials and personal information
• Deploy additional malware payloads for further exploitation
• Maintain persistence within compromised networks

Given the targeting of gaming utilities, the campaign likely exploits users seeking cracked software, mods, or cheats—common vectors for malware distribution in the gaming community.

Recommendations for Security Teams

To mitigate risks associated with this threat, organizations and individual users should:

• Block or monitor suspicious PowerShell executions, particularly those initiating Java-based processes
• Restrict downloads of untrusted gaming utilities, mods, or cheats from unofficial sources
• Deploy endpoint detection and response (EDR) solutions to identify anomalous Java runtime behavior
• Educate users on the risks of downloading software from unverified platforms
• Update and patch Java runtime environments to mitigate known vulnerabilities

Microsoft has not yet attributed this campaign to a specific threat actor or group. Further analysis is expected as more IoCs become available.