KBG RAT malware uses jump scares and forced blue screens

Security researchers at Group-IB have published a report on KBG RAT, a newly discovered remote access trojan that combines data theft capabilities with jump scares and forced blue screens.

The malware has been advertised on underground forums since late 2025, though Group-IB found evidence of related infrastructure dating to January 2022. The researchers say it is sold as a malware-as-a-service subscription: access costs $150 for one month or $800 for a year, which works out to about $67 per month. Even the least expensive plan includes remote desktop access, file management, webcam and microphone access, keylogging, password recovery, persistence, and anti-detection features. Higher-priced plans add features such as multi-client management and plugin support. A separate Network Spreading add-on costs $500.

KBG RAT can also monitor copied cryptocurrency wallet addresses and replace them with addresses controlled by attackers. Group-IB says its psychological harassment features include screamers, jump scares, and forced blue screens. The malware also uses obfuscation, sandbox detection, and methods to disable or bypass security protections. It sends infection notifications through a Telegram bot.

Group-IB found multiple operators using the same malware builder, including at least one focused on cryptocurrency theft. The researchers also found that the malware’s website claimed more than 10,000 IT professionals used the tool. When TechRadar tried to visit the site, it returned a “502 Bad Gateway” error; the report says that could reflect a temporary server or hosting problem, rather than a permanent shutdown.