KGB RAT trojan bypasses Windows Defender to spy on users

Security analysts at Group-IB have analyzed a Windows remote access trojan named KGB RAT that bypasses Windows Defender to steal credentials and spy on infected victims. Help Net Security, CyberSecurityNews, and GBHackers News all report that the malware is being sold on underground hacking forums for prices starting at 150 dollars per month. [1][2][3][4][5]

Help Net Security reported that Group-IB analysts Alpomish Asadov and Razvan Raducu examined the malware, finding it built upon the widely known NjRAT codebase. The trojan allows attackers to access webcams, microphones, keystrokes, and saved passwords. It also features options designed to frighten victims by playing audio screams. [1][4]

GBHackers News reported that KGB RAT utilizes a fully undetectable crypter to evade security controls like Windows Defender. According to Help Net Security, the trojan first appeared in public breach alerts in September 2025 before gaining broader tracking on forum promotions later that year. [1][5]