Webrat spread as fake exploit code on GitHub

Kaspersky's researchers have uncovered a campaign distributing the Webrat remote access trojan through GitHub. Since at least September 2025, the actor has created repositories posing as exploit code for high-severity vulnerabilities, with detailed descriptions and structured guides designed to build trust. Victims download a ZIP archive that drops an executable, in observed cases rasmanesc.exe. It escalates privileges, disables Windows Defender and retrieves Webrat from hard-coded command-and-control infrastructure. The trojan provides backdoor access with credential theft, screen recording, webcam and microphone capture, and exfiltration from services such as Telegram, Discord, Steam and cryptocurrency wallets.

What this means for your organisation

The target group is your own security and engineering staff, the users with the broadest access and the most exemptions from restrictions. Downloading and running exploit code from unfamiliar repositories is a common working habit, and it deserves a framework.

Berigo recommends

• Require that all exploit code testing happens in isolated analysis environments, never on the workstation.
• Remove standing local administrator rights from technical users who hold them permanently.
• Alert when endpoint protection is disabled, and treat it as an incident.
• Write a short policy for using code from open repositories and make it known in the engineering team.

Source

• securelist.com