STX RAT Hides Remote Desktop, Steals Data to Dodge Detection

Gbhackers •Mayura Kathir • April 9, 2026

A stealthy new remote access trojan, dubbed STX RAT, that blends hidden remote desktop control with powerful infostealer capabilities while using advanced evasion and encryption techniques to stay under the radar of security tools. The operators rely on opportunistic initial access, including malicious VBScript and JScript chains that download a TAR archive containing the core payload and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

STX RAT Emerges as Advanced Threat in Finance Sector The STX RAT, a previously undocumented remote access trojan, was identified in late February 2026 targeting the finance sector. It employs sophisticated stealth tactics, including multi-stage scripts and encrypted communication, to evade detection. Initial access is gained through malicious VBScript and JScript that download the core payload. Once installed, STX RAT allows attackers to remotely control infected machines and harvest sensitive information. The malware's design suggests ongoing development, with some features not yet operational. eSentire's Threat Response Unit is actively monitoring the situation and has isolated affected systems. Organizations are urged to enhance endpoint protections against script-based attacks. The threat is significant, given its potential for widespread exploitation in financial environments. 5 sources 68

Extracted Entities

STX RAT Hides Remote Desktop, Steals Data to Dodge Detection

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)