Executive Summary
In July 2026, security researchers at LevelBlue disclosed QuimaRAT, a new Malware-as-a-Service (MaaS) offering sold by an actor known as QuimaCODER. Built primarily in Java using Apache Maven, the RAT provides high portability across Windows, Linux, and macOS. It is marketed for subscription fees ranging from $150 to $1,200, lowering the barrier for entry by providing a builder, control panel, and technical support to its subscribers.
The malware utilizes a modular architecture where encrypted plugins are dynamically loaded from a Command and Control (C2) server, allowing operators to expand capabilities without modifying the initial binary. Key features include surveillance (keylogging, webcam access), credential recovery, and offensive command execution. The use of Java Native Access (JNA) libraries allows the malware to perform low-level OS interactions while maintaining its cross-platform nature.
QuimaRAT poses a significant risk to enterprise environments, specifically targeting developer workstations, CI/CD pipelines, and application servers where Java Runtime Environments (JRE) are ubiquitous. The emergence of such tools reflects a broader 2026 trend of increased commodity malware targeting non-Windows platforms, necessitating a shift in endpoint monitoring strategies for macOS and Linux systems.