A RAT (Remote Access Tool), in combination with phishing attacks, can compromise digital devices like mobile phones, tablets, laptops and desktops.
How a RAT-based attack works:
- First, the fraudster sends a phishing email with a link or attachment that appears legitimate.
- Once the victim clicks, the RAT is installed on that device without any notification to the user and automatically connects to a remote server controlled by the attacker.
- At this point, the attacker can:
- Steal sensitive data (passwords, financial details, etc.)
- Monitor user behavior through keylogging and screen recording
- Gain access to anything the user accesses using the infected device. This online access can let them set up fraudulent trades and/or money movements.
- This type of attack is difficult to detect for many reasons, including:
- The fraudulent activity is generated by a device that’s trusted by the user.
- These attacks may use legitimate applications, so the problem may not show up in antivirus/malware scans.
Example of a RAT Attack
A client receives a text message that appears to be from their financial institution, asking them to verify account information by clicking a link. This phishing text directs the user to a spoofed website, a RAT is downloaded to the device, and then the bad actor uses the remote tool to gain access to the user’s online accounts.
White Oaks recommends the following best practices:
- Close the browser window you use as soon as your session is over.
- Be sure reputable antivirus/anti-malware software is active on each device you use.
- Avoid clicking on unknown or unsolicited links or attachments.
- To avoid landing on spoofed websites, type a website’s full URL into your browser’s address bar, and then add it as a favorite for your convenience later.
- Remove recently downloaded applications that you do not recognize.
- Add unique, strong passwords and consider the use of a password manager.
- Always logout of websites once you are done with your task.
- Take advantage of advanced security features, such as multi-factor authentication, and biometrics.
- Keep devices updated and patched.
Remember: Reach out to any member of the White Oaks team to report any suspicious activity on your accounts or personal devices.
