zgRAT

zgRAT is a Windows malware label used in the wild for payloads delivered through multiple commodity malware chains and social-engineering campaigns. It has been observed as a second-stage payload delivered by loaders and crypters including SmokeLoader, DOILoader, Rhadamanthys, Cruciferra, StealC, and CastleLoader, and in campaigns using phishing emails, fake browser-update pages, and ClickFix-style lures. Targeting associated with zgRAT delivery has included hospitality and travel organizations, logistics firms, and broader opportunistic victim sets across sectors such as financial services, healthcare, and government.

The term "zgRAT" is used inconsistently across the security ecosystem and is not a stable family designation. Multiple researchers have noted that detections labeled zgRAT may actually refer to distinct PureCoder malware families, especially PureRAT and PureLogs. Because of this naming ambiguity, family-level capability claims should be treated cautiously unless a sample is independently classified. Even so, malware reported under the zgRAT label has repeatedly been associated with credential and browser-data theft, cookie theft, cryptocurrency-wallet theft, and remote-access functionality. Some campaigns have also paired zgRAT with PureHVNC or other remote-control tooling, and some detections tied to zgRAT have involved Discord webhooks for exfiltration.

Observed delivery chains commonly rely on Windows-focused execution methods such as malicious Office exploit chains, DLL sideloading, trojanized update installers, archive-delivered shortcut or executable launchers, and staged PowerShell downloaders. In several 2025-2026 campaigns, hospitality-themed lures such as guest complaints and bed-bug reports were used to deliver zgRAT, including activity linked to the Chinese-speaking threat actor TA4922 via the Cruciferra crypter service. The malware has also appeared in fake Chrome update campaigns on compromised websites and in tax- and logistics-themed intrusion chains. Overall, zgRAT is best understood as a commonly referenced but taxonomically ambiguous Windows malware designation associated with credential theft, data exfiltration, and remote-access operations in commodity cybercrime campaigns.