🚨 Bybit's security team has uncovered a malware campaign targeting macOS users searching for Claude Code. SEO poisoning redirects victims to fake installer pages built to steal crypto wallet credentials and grant remote device access.

Got some good news
from the camp of

🧩 Reversal_X_Mods 🧩

😄😄😄😄😄😄😄😄

Especially to those that love

🛎 Munowatch 🛎

This year's best award in

🦠 interception or hooking 🦠

should go to......

🧩 Reversal_X_Team 🧩

😂😂😂😂😂😂😂😂

🪲🪀🪀🪀🪀🪀🪀🪀🪲
🤡 𝗠𝗨𝗡𝗢𝗪𝗔𝗧𝗖𝗛 𝗩𝗜𝗣 🤡
🪲🪀🪀🪀🪀🪀🪀🪀🪲

📯 No VPN / Proxy 📯

📯 No Account Injection 📯

📯 Auto Login 📯

📯 Download Movies
To your phones storage📯

📍📍📍📍📍📍📍📍📍📍📍

⚠️ WARNING: DO NOT INSTALL CRAXRAT ON YOUR MAIN PC


I have a lot to say about this tool. I installed CraxRAT v8.0 and it immediately deployed itself silently. Here is what it does the moment you run it:
🔴 What it does:
— Blocks Task Manager so you can't see or kill its processes

— Blocks regedit, msconfig, to stop you from investigating or removing it

— Adds itself to 5 registry Run keys disguised as legitimate Windows names:
　　• WindowsHealthMonitor → AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
　　• SysHelper → AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
　　• connect → AppData\Roaming\SubDir\Client.exe
　　• Wihnup → AppData\Roaming\Wihnup.exe
　　• MsEdgeUpdate → AppData\Roaming\p55o7W7J7u\svchost.exe

— Drops random named shortcuts in your startup folder:
　　• BemUCYyI.lnk, BROGKlqcvtKWd.lnk, GyyECYr.lnk, mBwJZznk.lnk, VtbFHpW.lnk
　　• Location: AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

— Drops fake update executables in the same startup folder:
　　• update1.exe, update2.exe, update3.exe, update4.exe, update5.exe, update6.exe, UpdateDownloader.exe

— Creates a fake scheduled task called MsEdgeUpdate pointing to:
　　• AppData\Roaming\4yRcKI2oMLi1wdSy\svchost.exe
— Runs in memory disguised as "VirtualQuantum" so you won't recognise it

I ran Malwarebytes full scan — it found NOTHING. This RAT evades AV completely.
Symptoms: PowerShell flashing at startup, random Notepad opening, Task Manager blocked, regedit and msconfig inaccessible.
I had to manually kill processes with Process Hacker, delete all registry keys, wipe the startup folder, and remove the scheduled task before it was fully gone.
If you want to study it, use an isolated VM. Not your main machine.
Stay safe 🙏