Remote-Access Trojans (RATs)
Malware gives an attacker covert remote control of a device.
What it is
A remote-access trojan, or RAT, gives an attacker covert control over a device. Depending on its capabilities and permissions, it can access files, capture input, observe activity, or run additional software. Legitimate remote-support applications can also be abused, but authorized support and a covert malicious agent are not the same thing.
How it works
A deceptive installer, attachment, or exploited flaw starts the agent. It communicates with an operator and may configure itself to return after restart. The attacker can then act interactively, collect information, or use the device as a foothold into other systems.
How people get tricked
An apparently useful download hides the control component, or a fake technician persuades the user to install remote software voluntarily. A normal-looking desktop does not prove that no remote operator is present.
Example scenario
A supposed interview assessment installs an application that quietly lets an attacker browse work files and open other programs under your account.
Warning signs
- Unexpected remote-control software, services, or startup entries.
- Unexplained connections or endpoint alerts involving remote commands.
- Cursor movement or camera activity can be clues, but many agents operate without visible signs.
How to protect yourself
- ✓ Install only verified software and independently confirm support identities.
- ✓ Restrict administrator privileges and approved remote-access tools.
- ✓ Patch endpoints and monitor remote connections and persistence changes.
- ✓ Avoid exposing management services directly to untrusted networks.
If it happens to you
Isolate the device and seek qualified investigation. Determine what the operator accessed and whether other systems were reached. Rebuild when trust cannot be restored, then rotate affected secrets and revoke sessions from a clean device; uninstalling one visible tool may not remove every access path.
Know this now
Remote control is a capability, not just a screen-sharing window. Investigate what the attacker could do under the compromised account.