New Webrat Virus Steals Gamers' Data and Spies Through Webcams

Experts from the Solar 4RAYS cyber threat research center of the Solar group of companies have discovered new Webrat malware that spies on victims through their desktop screen or webcam, stealing data from browsers, crypto wallets, game stores, and instant messengers. The malware disguises itself as cheats for popular games such as Rust, Counter-Strike, and Roblox, as well as various programs, spreading through pirate sites, GitHub, and even YouTube comments. The first versions of Webrat appeared in January 2025 and are sold to attackers on the darknet.

Webrat's main function is to steal Steam, Discord, and Telegram accounts, as well as crypto wallet data. However, the malware also allows attackers to fully control the infected computer, download blockers and miners. It is embedded in cheat programs, player verification utilities, and even "patched" versions of applications blocked in Russia, such as Discord.

Distribution occurs via GitHub, pirate sites, and YouTube, where attackers leave links to malicious archives in the comments to videos with installation instructions. Victims can include not only gamers, but also employees of companies using pirated software. Attackers use stolen data for blackmail, swatting (false calls to the police), or compromising corporate information.

To protect against Webrat, Solar 4RAYS experts recommend using a reliable antivirus and avoiding downloading software from unverified sources.