Jump to content

Draft:CyberEye RAT

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Cisamu (talk | contribs) at 16:25, 23 June 2025 (Reduced content and added only verified sources (CYFIRMA, Ampcus, IBM) as per reviewer feedback.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

CyberEye is a modular remote access trojan (RAT) that primarily targets Microsoft Windows. Developed in .NET, it uses a GUI builder for payload customization and communicates with its operator through the Telegram Bot API.

Overview

CyberEye allows attackers to generate customized malware with features like keystroke logging, clipboard hijacking, screenshot capture, and credential theft. It includes anti-analysis methods such as virtual machine detection and disables Windows Defender via PowerShell scripts.

Technical Analysis

In June 2025, cybersecurity firm CYFIRMA published a technical analysis detailing CyberEye's architecture and behavior.[1] Other reports have appeared from:

References

  1. ^ "Understanding CyberEye RAT: Builder Capabilities and Implications". CYFIRMA. 2025-06-10. Retrieved 2025-06-22.
  2. ^ "CyberEye: The Telegram-Based RAT Targeting Windows Users". Ampcus Cyber. Retrieved 2025-06-22.
  3. ^ "X-Force Intelligence Alert: CyberEye Analysis". IBM X-Force Exchange. Retrieved 2025-06-22.

Categories