Back Cybersecuritynews

Hackers Push CrystalX Malware-as-a

Cybersecuritynews •Tushar Subhra Dutta • April 1, 2026

A new and dangerous piece of malware has surfaced and is being marketed openly to cybercriminals through private Telegram channels. Named CrystalX, this Malware-as-a-Service (MaaS) platform combines a remote access trojan (RAT), credential stealer, keylogger, clipboard hijacker, spyware, and an unusual set of prankware tools into one capable package. Discovered in March 2026, the malware […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CrystalX RAT: New Malware Combines Data Theft and Prankware Features In March 2026, cybersecurity researchers discovered CrystalX RAT, a new malware-as-a-service (MaaS) being promoted in private Telegram channels. This malware offers a wide range of capabilities, including remote access, data theft, keylogging, and unique prankware features designed to disrupt and mock victims. CrystalX RAT can steal credentials from platforms like Steam, Discord, and Telegram, and manipulate clipboard contents to facilitate cryptocurrency theft. The malware was first identified in January 2026 as WebCrystal RAT before being rebranded. It operates on a subscription model with three tiers, making it accessible to less skilled cybercriminals. The malware connects to its command-and-control server via WebSocket and has been noted for its user-friendly interface. As of the latest reports, the initial infection vector remains unknown, but the malware is actively evolving, with new versions being detected. Victims are primarily located in Russia, and the threat is expected to grow. 10 sources 71

Hackers Push CrystalX Malware-as-a

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)