GoodPersonRAT Uses Fake LetsVPN Installer to Give Attackers Full Remote Control

Cybersecuritynews •Tushar Subhra Dutta • July 9, 2026

A fake installer for a popular Chinese VPN service is quietly handing full remote control of infected computers to unknown attackers. The malicious file poses as a setup tool for LetsVPN, a tool many users in China rely on to bypass strict internet blocks. Instead of just installing the VPN, it also drops a hidden […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GoodPersonRAT Malware Distributed via Fake LetsVPN Installer A new remote access trojan (RAT) named GoodPersonRAT is being distributed through a malicious installer that pretends to be the legitimate LetsVPN software. The installer, identified as Kuailian_win-setup.86.msi, drops and executes an encrypted RAT, allowing attackers full control over the victim's machine. This malware is designed to evade detection by loading its payload directly into memory without writing it to disk. It features extensive capabilities, including keylogging, screen monitoring, and clipboard theft, specifically targeting Telegram Desktop users. The malware connects to a selection of 40 command-and-control servers, some of which translate to 'you are a good person' in Chinese. Users are warned to verify software integrity before installation to avoid such threats. The attack primarily affects users in China who rely on VPNs to bypass internet censorship. 4 sources 70

Extracted Entities

GoodPersonRAT Uses Fake LetsVPN Installer to Give Attackers Full Remote Control

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)