KGB RAT can display a fake blue screen of death on a Windows PC, flash frightening images and play screams while giving an attacker tools to steal passwords and watch through the webcam. These aren’t pranks built into harmless software. They’re intimidation tools bundled with a remote-access Trojan.
The malware’s developers describe its psychological harassment functions as fun extras. As TechRadar reports, that framing turns victim distress into a selling point: attackers can frighten someone at their desk while stealing their data. With Halloween approaching, the scares have a seasonal hook, but the criminal capabilities behind them are far less theatrical.
Security researchers at Group-IB recently published a technical analysis of KGB RAT. The recently discovered Windows Trojan has been sold on various dark web forums since late 2025. Evidence suggests its underlying infrastructure may have existed as early as 2022, prompting researchers to suspect that the developers used the tool themselves before selling it to other cybercriminals. That earlier private use remains a hypothesis, not an established fact.
KGB RAT is offered as malware-as-a-service, or MaaS, with subscriptions starting at $150 per month. An annual subscription is also available. Even the cheapest package includes remote access to the victim’s computer, microphone and webcam; keystroke logging, also known as keylogging; password capture; techniques intended to make detection harder; and the ability to hijack cryptocurrency transactions.
After infection, the scare functions kick in: a fake blue screen, frightening images and screams. TechRadar criticizes the developers’ casual treatment of these features, arguing that they let attackers heighten victims’ anxiety while stealing their data. Calling them entertainment doesn’t change how they’re used.
The report doesn’t establish how many computers have been infected worldwide or how widespread KGB RAT is in Hungary. That doesn’t mean users there are safe from similar attacks.
In the infection chain described by Group-IB, the user must first run the malicious file. That makes unverified attachments and applications downloaded from dubious sources, particularly in response to suspicious requests, a concrete risk. The researchers recommend keeping antivirus protection active and up to date, and treating unexpected requests for administrator permission with care.
