Experts uncover bizarre new malware that spooks users with jump scares and screams

KGB RAT is a malware-as-a-service platform offering remote access, credential theft, and crypto hijacking features The malware includes unusual psychological tactics such as fake BSODs, jump scares, and screamer functions Researchers found multiple operators using the tool, which is marketed as legitimate software despite its criminal capabilities Halloween is just around the corner, and cybercriminals are making use of it to give Windows users a good scare (and then some!) - ater all, few things strike fear into the hearts of Windows users quite like the infamous Blue Screen of Death (BSOD), and a newly analyzed malware strain is turning that nightmare - into a weapon.

Security researchers Group-IB have published an in-depth report on KBG RAT, a newly discovered Remote Access Trojan (RAT).

The malware has been advertised for sale on underground forums since late 2025, although researchers found evidence of its infrastructure dating back to January 2022.

It’s quite possible that it was used privately for a little while before its developers decided to share it with the community.

KGB RAT KGB RAT is offered as Malware-as-a-Service (MaaS), Group-IB explained, saying subscriptions start at $150 per month and reach $800 annually.

The $150 package provides one month of access, while the $800 one covers the entire year, working out to roughly $67 per month for the annual subscription.

According to Group-IB, even the cheapest package includes all of the biggest features - remote desktop access, file management, webcam and microphone access, keylogging, password recovery, endpoint persistence, and different anti-detection features.

KGB RAT can also hijack cryptocurrency transactions by monitoring the clipboard for copied wallet addresses and replacing them with the ones owned by the attackers during pasting.

The more expensive plans, on the other hand, include multi-client management, payload customization, additional evasion features, plugin support, and access to more extensive server infrastructure.

The unnamed developers are also offering a separate $500 Network Spreading add-on, which apparently allows the malware to propagate automatically throughout compromised networks.

Boo! What makes this RAT stand out, however, are not its hacking features, but rather - thriller ones.

In the report, Group-IB describes them as “a set of psychological harassment features”, which include screamer functions, jump scares, and forced blue screens of death.

“Psychological harassment” might be a bit too harsh of a classification for a jump-scare during Halloween, but we would argue that what Microsoft did with its OS after Windows 11 could fall under that category.