Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

Hackers can now rent a Windows-focused remote access tool called VectraRAT for $250 a month, lowering the barrier to deep and persistent compromise.

The malware gives paying operators a way to watch victims, steal data, run commands, and move traffic through an infected computer. VectraRAT has surfaced as a rental-only malware service rather than a one-off tool used by a single group.

Investigators linked it to campaigns that use the Amadey loader and ClickFix pages, where fake verification prompts persuade people to run copied commands on their own devices.

SOCRadar said in a report shared with Cyber Security News (CSN) that its Threat Research Unit identified the previously undocumented platform after an exposed online directory revealed samples, server files, licenses and operator logs.

The investigation began on June 23 and expanded to more than ten related servers. The risk is not limited to home users. Of the victim entries with operating-system data, 48 percent were corporate Windows editions, including Enterprise and Windows Server 2025.

Researchers recorded 38 genuine victim sessions in less than a week, with evidence of file theft from business systems.

Hackers Can Rent VectraRAT for $250

The developer, operating as Vectra and previously known as Nyxel, keeps the source code and rents access to the control server, Windows implant, payload builder and support channel.

This model allows customers to launch operations without having to develop their own remote-control malware or maintain a complete command system.

VectraRAT is different from many forum offerings because its Linux server, Windows implant, management panel and network protocol appear to have been built together, rather than repackaged from leaked code.

That does not make it invisible, but it can complicate detection rules built for familiar malware families, as recent Windows RAT credential theft cases also show.

Once installed, the implant can open a hidden desktop that victims do not see, record keystrokes, run Command Prompt or PowerShell, transfer files and turn a compromised system into a proxy.

It also collects browser credentials, network details and configuration files containing possible API keys or database strings when it first connects.

The tool includes a privilege-escalation option that can raise its access level without displaying a Windows prompt. Its approach abuses trusted Windows processes, a pattern that mirrors concerns raised by Windows account-control bypasses and gives an intruder more freedom to access protected data or deploy follow-on malware.

ClickFix Delivery Raises the Stakes

Researchers observed buyers delivering VectraRAT through Amadey and through ClickFix lures impersonating TurboTax. In a ClickFix attack, a fake CAPTCHA or verification page instructs the visitor to open the Run dialog and paste a command, converting a social-engineering trick into malware execution.

Recent ClickFix malware attack reporting illustrates how widely the tactic is being adapted. The operators can also change the implant’s callback address after installation, reducing the need to rebuild and redistribute the file when infrastructure changes.

The malware uses a custom TCP-based communication method over a non-standard channel rather than normal web traffic, while the panel and related services use separate ports.

For defenders, the most practical prevention step is simple: a website that tells a person to open Run, Command Prompt, Terminal or PowerShell and paste a verification command is not legitimate.

Security teams should block the listed infrastructure, hunt for the host and network indicators below, and investigate unexpected child processes launched by Windows auto-elevation utilities.

They should also watch for unusually long outbound connections, especially where the traffic has no recognizable application pattern at all.

Monitoring copied-command activity and PowerShell launched soon after clipboard writes can help catch the delivery chain early, a safeguard reinforced in coverage of ClickFix phishing campaign tactics.

VectraRAT shows how a modest monthly subscription can give less-skilled criminals a ready-made route to credential theft and lasting access inside Windows networks.

The combination of broad delivery campaigns, automated collection and corporate victims makes rapid blocking, endpoint review and user awareness essential.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs appeared first on Cyber Security News.