A new Windows Remote Access Trojan (RAT) named Steaelite has emerged in cybercrime forums, blending data theft and ransomware into a single, potent tool. First identified in November 2025, Steaelite is marketed as malware-as-a-service, making it accessible for $200 per month. It notably simplifies what were previously complex double extortion ransomware campaigns by integrating multiple malicious functions into a streamlined browser-based dashboard.
Steaelite’s feature set is comprehensive, covering credential theft, cryptocurrency stealing, real-time surveillance through screen streaming, webcam and microphone access, keylogging, and a clipper for hijacking cryptocurrency transactions. It automates the process of data harvesting as soon as a victim connects to the internet, often before attackers even open their control panel. This automation is a significant advantage, as it consolidates operations that typically required several distinct malware tools.
As an added threat, the developers are reportedly working on an Android module, potentially expanding its attack scope to mobile devices, vital for activities like two-factor authentication. This development poses a new risk as mobile device security becomes an essential target for cybercriminals.
Security experts, like those at BlackFog, advise emphasizing data exfiltration prevention strategies. Given Steaelite’s design to bypass initial security defenses and target sensitive data, relying solely on perimeter defenses might be insufficient. Instead, organizations need to enhance their focus on impediments to data extraction to mitigate the risks posed by such sophisticated tools.

Collections

Steaelite is a new Windows RAT discovered in November 2025, sold as malware-as-a-service for $200/month on cybercrime forums. It combines credential theft, cryptocurrency stealing, keylogging, screen/webcam/microphone surveillance, and ransomware capabilities into a single browser-based dashboard. The tool automates data harvesting upon victim internet connection, consolidating what previously required multiple separate malware tools. Developers are also building an Android module to target mobile devices, including 2FA interception. Security experts recommend prioritizing data exfiltration prevention over perimeter-only defenses to counter such threats.

Steaelite RAT: A Unified Tool for Data Theft and Ransomware Extortion