Yet that\u2019s only the harmless side of the malware \u2014 the prank functionality that harks back to the joke viruses of past decades. The real damage from CrystalX comes from its stealing login credentials for Steam, Discord, Telegram, and all Chromium-based browsers. It can also monitor and change the contents of the clipboard; typically, attackers watch for a crypto wallet address to be copied, and then swap it with their own. This is a popular scheme for stealing crypto<\/a>: while intending to make a legitimate transfer, the victim copies the recipient\u2019s wallet address, but ends up pasting the scammers\u2019 address instead.<\/p>\n But there\u2019s more: a keylogger feature and full device control with remote access to the screen, camera, and microphone \u2014 including video and sound recording capabilities.<\/p>\n The malware was first mentioned in January 2026 in a private Telegram chat for RAT developers. At that time, this Windows Trojan was called WebCrystal RAT and, based on technical details, was revealed to be a clone of another RAT known as WebRat<\/a>. A short time later, the author of WebCrystal rebranded it as CrystalX RAT, and began touting the Trojan on a newly created Telegram channel.<\/p>\n The initial infection vector for this stealer is currently unknown, but according to telemetry the victims at the time of writing are predominantly located in Russia. And since we\u2019re continuing to find new versions of the malware, we deem it a rapidly growing and evolving threat.<\/p>\n Developing any complex cyberattack used to come with a steep learning curve. You needed to understand cryptography and network protocols, and know how to write code that could fool antivirus solutions. It was a high bar to clear, but the malware-as-a-service model has been changing the game.<\/p>\n These days, an attacker only needs basic computer literacy to rent a ready-made platform with a user-friendly user interface. The threat is becoming widespread specifically because malware creators aren\u2019t carrying out the attacks themselves anymore \u2014 they\u2019re selling shovels during a gold rush. They focus on supporting their customers, improving the user interface, and pouring money into aggressive marketing.<\/p>\n CrystalX malware control panel<\/p><\/div>\n Hackers are even setting up YouTube channels where they use the pretext of \u201cfor educational and entertainment purposes\u201d to explain how to manage the Trojan from the control panel. Instructional videos that were once buried in the dark web have gone mainstream, putting hacking techniques in front of a broad, general audience.<\/p>\n No matter how technically advanced a hacking app\u2019s code is, it will die as a project without a constant stream of new clients. This makes marketing efforts vital to its survival \u2014 even if they significantly increase the risk of the developer ending up behind bars. However, the creators of CrystalX have figured out how to protect their creation.<\/p>\n The control panel allows clients to build their own unique versions of the Trojan with extensive configuration options. For example, they can enable location filtering to target users in specific countries, choose an icon for the executable file, and toggle anti-analysis features. The finished Trojan is compressed using zlib and then encrypted with a ChaCha20 stream cipher using a 256-bit key and a 96-bit nonce<\/a>. This ensures that every customer receives a unique version of the malware.<\/p>\n CrystalX is also capable of detecting virtual machines and checking if it\u2019s running in a test or debugging environment, which complicates discovery. You can read more about the structure and functionality of this new Trojan in our Securelist story<\/a>.<\/p>\n The good news for Kaspersky users is that our security solutions<\/a> both detect and neutralize CrystalX.<\/p>\n Here are a few simple tips to help you avoid infection by CrystalX and other similar malware:<\/p>\n Read more about remote access Trojans, miners, crypto-stealers, and other digital nasties:<\/p>\n The new CrystalX remote access Trojan looks like the prank viruses of the 90s on the surface, but it causes a lot more damage. It spies on all that\u2019s happening on your computer, steals cryptocurrency and accounts, and gives the attacker full control over your device. We break down how it works, and how to avoid becoming a victim.<\/p>\n","protected":false},"author":312,"featured_media":25409,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1486],"tags":[1505,575,714,682,2151,738,783,692],"class_list":{"0":"post-25406","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-cryptocurrencies","9":"tag-great","10":"tag-rat","11":"tag-spyware","12":"tag-stealers","13":"tag-surveillance","14":"tag-tracking","15":"tag-trojans"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/prankware-crystalx-rat-maas\/25406\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/prankware-crystalx-rat-maas\/30356\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/prankware-crystalx-rat-maas\/30203\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/prankware-crystalx-rat-maas\/41616\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/prankware-crystalx-rat-maas\/55537\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/prankware-crystalx-rat-maas\/33372\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/prankware-crystalx-rat-maas\/30473\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/prankware-crystalx-rat-maas\/36092\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/prankware-crystalx-rat-maas\/35744\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/rat\/","name":"RAT"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/25406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/312"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=25406"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/25406\/revisions"}],"predecessor-version":[{"id":25410,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/25406\/revisions\/25410"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/25409"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=25406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=25406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=25406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Anyone can become a hacker<\/h2>\n
![\"CrystalX](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2026\/04\/01190623\/prankware-crystalx-rat-maas-01.jpg\")
<\/a>How CrystalX bypasses security<\/h2>\n
How to avoid becoming a victim<\/h2>\n
\n
\n