AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems

A newly tracked Windows remote access trojan called AgtaBackup RAT is using fake Microsoft Store pages to gain a foothold on victims’ computers.

The campaign pretends to offer popular video-conferencing software, but the download instead installs a legitimate remote monitoring and management, or RMM, tool that attackers control. That first step matters because the installer is genuinely signed and the installation appears normal.

After a victim accepts a Windows User Account Control prompt, the RMM client enrolls the computer in an attacker-controlled account, giving the operators quiet remote access that can blend with routine support activity. Analysts at Palo Alto Networks Unit 42 identified the malware through campaign artifacts.

Palo Alto Networks Unit 42 said in a report shared with Cyber Security News (CSN) that the custom .NET backdoor enables long-term control, data theft, and surveillance.

The report gives no victim count or affected country list. Once operators gain access, they can install the RAT, run commands, take screenshots, record keystrokes, and collect browser data.

The approach shows why security teams must judge unexpected remote-access software by its delivery and behavior, not just whether it appears trusted.

AgtaBackup RAT Uses Fake Microsoft Store Pages

The infection begins on a landing page made to resemble a Microsoft Store product listing for video-conferencing software.

Clicking the advertised download can deliver an RMM MSI package, including products such as LogMeIn Resolve or ConnectWise ScreenConnect, instead of the expected application.

Similar fake Microsoft Store pages have hidden harmful downloads behind familiar branding. Victims see a standard installer and UAC consent request.

When approved, the RMM service runs with SYSTEM-level privileges and connects to its normal cloud infrastructure, while the endpoint is linked to the attackers’ tenant.

This gives the intruders a hands-on terminal session without first deploying an obviously malicious remote-control program.

After a delay that can last hours or days, the operators use that session to run a PowerShell command that downloads the AgtaBackup installer and launches a quiet MSI installation.

This pattern resembles earlier legitimate RMM tool abuse, where trusted administration software becomes a bridge to a second-stage payload.

The RAT installs as a hidden SYSTEM service and uses a misleading name to appear related to Windows security. Two scheduled tasks run every minute and at startup.

If defenders stop the service or remove its directory, these components can restore the malware within 60 seconds, making partial cleanup risky.

Credential Theft and Detection Steps

AgtaBackup RAT checks in with its control server every two seconds and opens a WebSocket channel for live commands.

It inventories the device and can run PowerShell, move files, stage extra software, capture screenshots, and operate a hidden desktop for covert operations. That workspace lets attackers use command shells without showing a visible window to the logged-in user.

The malware targets saved credentials, cookies, history, bookmarks, and other profile data from nine browser families, including Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Chromium, and Yandex.

It also starts a separate keylogger disguised as a Windows security process. The combination raises the risk of account takeover, alongside the browser credential theft risks seen in other RAT operations.

Researchers found that the malware can change a Windows setting to move UAC prompts off the protected desktop, then inject input into them remotely.

It further conceals activity through a restrictive service permission setting that limits visibility for non-SYSTEM users, including local administrators. These features make early detection of the delivery chain especially valuable.

Security teams should investigate unapproved RMM enrollment, particularly when an RMM process launches PowerShell to download an MSI followed by a silent msiexec command.

They should also alert on repeated service-restoration tasks, machine-level control settings, unsigned SYSTEM processes reading several browser-store files, and unusual control traffic during incident response.

Users should obtain updates only through official sources, a safeguard also stressed in coverage of the fake Teams update campaign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems appeared first on Cyber Security News.