ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT

Key Takeaways

  • ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026 targeting domain-joined hosts.
  • The CrashFix campaign delivers it through a fake NexShield Chrome extension that crashes the browser, then shows a repair prompt.
  • C2 traffic uses HTTP port 80 with RC4 encryption, zlib-compressed JSON, and adaptive beaconing intervals.
  • Eight command types give operators full remote code execution, payload deployment, self-update, and clean implant termination.
  • The Picus Platform simulates CrashFix ModeloRAT attacks so teams can validate security controls against this threat.

ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026, delivered only to domain-joined hosts in enterprise environments where a single foothold opens the way to Active Directory and lateral movement.

Article Link: ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT