Executive Summary
In early 2026, a new Malware-as-a-Service (MaaS) platform named CrystalX (formerly Webcrystal or WebRAT) emerged, promoted via Telegram and YouTube. Written in Go, the malware offers three subscription tiers and features a comprehensive arsenal including a stealer, keylogger, clipper, and remote access Trojan (RAT) capabilities. Notably, it distinguishes itself with a 'Rofl' module designed to harass victims through screen rotation, peripheral disruption, and chaotic cursor movement.
The technical delivery involves an auto-builder with advanced anti-analysis features such as MITM checks, VM detection, and stealth patches for AMSI and ETW. The malware utilizes WebSockets for C2 communication and leverages the ChromeElevator utility for harvesting browser credentials. While initial infections have been observed primarily in Russia, the MaaS model and lack of regional restrictions suggest a high potential for global expansion.
This threat is significant due to its multifaceted nature; it serves as both a high-efficiency data exfiltrator and a disruptive tool. The active development and aggressive marketing campaigns indicate that CrystalX is likely to see increased adoption by diverse threat actors, ranging from financial criminals to those seeking to cause operational disruption.