Overlord RAT

Overlord RAT is a Golang-based remote access trojan used in real-world intrusions and also seen in open-source-derived variants such as SpaceX1337. It has been observed as a follow-on payload after successful compromise, including post-exploitation activity against vulnerable WordPress environments and user-driven execution chains such as ClickFix-style social engineering. Reported delivery methods include tax-themed phishing campaigns using malicious virtual disk images and execution chains that rely on DLL sideloading, in-memory shellcode loading, and anti-analysis measures to evade detection.

Observed capabilities include remote access functionality, credential theft, cryptocurrency theft, and hidden virtual network computing functionality in at least one identified variant. Overlord RAT has also been loaded directly into memory through staged PowerShell-based loaders that suppress AMSI and PowerShell telemetry, manually map encrypted payloads, and establish persistence through COM hijacking. In monitored intrusions, operators used the malware during active command-and-control sessions and conducted rapid theft of sensitive files, browser session material, internal communications, and cryptocurrency wallet data.

The malware has been associated with opportunistic criminal activity rather than a single confirmed threat actor. It has appeared in campaigns abusing trusted platforms and legitimate workflows, and in at least one case attackers repeatedly attempted to deploy it onto WordPress sites compromised through the WP2Shell exploit chain. Its use illustrates how publicly available offensive tooling can be adapted into operational malware for credential theft, post-exploitation access, persistence, and data theft across Windows environments.