vulnerability
Millenium RAT: a $10 trojan with 62,000 victims
2026-06-29
Group-IB has been quietly tracking a piece of malware called Millenium RAT, and the numbers are worth pausing on. 62,289 infected Windows devices across more than 160 countries, with almost 40,000 of those infections landing in the first quarter of 2026 alone.
What makes it interesting isn't the code. It's the price tag.
Cheaper than Netflix
The developer, who goes by ShinyEnigma, runs the whole thing like a budget SaaS product. Fifty dollars for the first month. Ten a month after that. Ninety for lifetime access. For roughly the cost of a streaming subscription, a buyer gets a tool that can:
- Lift saved credentials and data from browsers
- Log keystrokes
- Grab screenshots and record audio
- Drop additional files onto the machine
- Encrypt files, or simply blue-screen the device for amusement
That is a full-featured remote access trojan at a price point that puts it in reach of anyone with pocket change and bad intentions.
Boring tech, clever plumbing
The latest version has been rebuilt from .NET into native C++, which helps it slide past the weaker end of antivirus detection. Command and control runs through the Telegram Bot API, which is the genuinely clever bit. The operators don't have to stand up any infrastructure of their own, and the malware's traffic looks like ordinary Telegram chatter on the wire.
There are no exploits in play. No zero-days, no chained vulnerabilities, nothing exotic. Millenium RAT uses standard Windows functions, and when it needs administrative rights it does the laziest thing imaginable: it pops up the normal User Account Control prompt and waits for the victim to click Yes.
That is the entire attack chain. A prompt, and a click.
Hidden in the usual places
The distribution is equally low-effort. The crew behind the campaigns, tracked as Y2K Operators, bundles the trojan into game cheats, cracked software and hacking tools. In other words, the kind of files that get downloaded by people who have already decided to ignore every warning their browser and operating system have ever given them.
There is also a small piece of poetic justice in the research. Group-IB found Y2K Operators backdooring builders for two other well-known trojans, AsyncRAT and XWorm, so that other would-be criminals infect themselves while trying to set up their own attacks. Hard to feel sorry for the victims in that particular subset.
The actual story
The interesting part of Millenium RAT is not the technology, because there isn't much. The interesting part is the economics. A capable, full-featured trojan now costs less than lunch, runs on free public infrastructure, and depends on nothing more sophisticated than a user clicking Yes on a prompt they weren't expecting.
The barrier to running a half-decent cybercrime operation has dropped to roughly the cost of a coffee. The barrier to stopping one, on the other hand, still mostly rests on whether the person at the keyboard pauses for a second before approving something they didn't ask for.