LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts
New Rust-based RAT, LabubaRAT, impersonates NVIDIA software to gain Windows host access.
A new remote access trojan (RAT) named LabubaRAT, written in Rust, has been discovered impersonating NVIDIA software to infiltrate Windows systems. It functions as a malware-as-a-service, allowing attackers to profile hosts, execute commands, exfiltrate data, and proxy traffic. LabubaRAT employs multiple communication methods, including HTTPS, WebView2, and DNS tunneling, to maintain persistence and evade detection.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NVIDIA?
Get an email when a new story names NVIDIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLabubaRAT exploits users' trust in legitimate software brands like NVIDIA to trick victims into executing a malicious remote access trojan. By masquerading as trusted software, attackers bypass user skepticism and potentially weak application controls, gaining full command-and-control over compromised hosts. The malware's use of multiple evasion techniques — including DNS tunneling, HTTPS, and WebView2 — makes it difficult to detect with standard security tools. This highlights how social engineering combined with advanced obfuscation can render both users and security tooling ineffective if not properly configured and trained against such threats.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — pipicka[.]xyz
- malware — LabubaRAT