Darktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C).
Dubbed CikaBika Bot , the malware has been distributed via document-themed lures, likely as part of phishing attacks, and provides attackers with reconnaissance, remote execution, and data exfiltration capabilities on infected systems.
Victims receive a PDF file containing a disk image with a Windows shortcut (LNK) posing as a Word document. Once opened, it displays a decoy document and launches a hidden PowerShell process to decode and run an embedded executable.
The executable is a Nim-based loader containing a Rust DLL and a PowerShell deployment script that are written to temporary files. The script then attempts to move the DLL into the protected Edge directory to bypass Windows’s User Account Control (UAC).
According to Darktrace, the attackers likely attempt to sideload the malicious code through DLL -order hijacking by exporting functions associated with Microsoft’s debugging library.
The final payload is the CikaBika Bot RAT, which immediately registers the infected machine with Discord and starts its reconnaissance routine, harvesting system information, processes, and network configuration, and taking a screenshot.
Commands and reports are transmitted via Discord, which is used as an interactive interface. The operator can issue command execution, reconnaissance, process enumeration/termination, file upload/download, and surveillance (screenshot, camera, streaming, and broadcasting) commands.
According to Darktrace, the attackers can use the RAT to compress directories into ZIP archives and exfiltrate them via Ngrok, and can request specific documents from the victim’s system.
“The observed use of Discord channels for individual victims, alongside additional data exfiltration through Ngrok, shows how legitimate services can be repurposed to support malicious operations,” Darktrace notes.
Related: XWorm RAT Evolves Into Surveillance Platform
Related: In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Related: Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026.
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation.
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network
The US government continues its crackdown on Tren de Aragua over its ATM jackpotting scheme.
Artificial Intelligence
Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
The personalized versions of ChatGPT were used to impersonate legitimate products and trick users into executing PowerShell commands.
Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft
The malware framework uses a modular architecture and a custom executable file format for long-term persistence.
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
