Researchers have identified a new MaaS platform called VectraRAT, a full-stack toolkit for cybercriminals This article explores attacker infrastructure credential. . Threat hunters claim this feature sets VectraRAT apart from cheaper “$50-tier” RATs by its built-in UAC bypass, which silently elevates a process to high integrity without displaying the standard Windows consent prompt.

Once deployed, VectraRAT automatically harvests stored browser credentials and scans compromised hosts for sensitive files such as .env, .conf, and .config files as soon as a victim connects to the attacker’s infrastructure. Beyond credential theft, the implant provides hidden desktop access (HVNC) for covert remote control, remote CMD and PowerShell execution, keylogging and clipboard hijacking with regex-based replacements, file transfer and process discovery, and SOCKS5 proxying for traffic relay.

Key indicators of compromise include a distinctive C2 override file, outbound TCP 3308 connections tied to the auto-elevation abuse routine, a debug API sequence, and hidden PowerShell process spawns. Security teams are advised to set UAC to "Always Notify," strip standing local administrator rights from end users, monitor HKCU registry paths commonly abused for elevation bypass, enable PowerShell Script Block Logging, and deploy application allow-listing via AppLocker or WDAC.