{
  "name": "AI Waifu RAT: A Ring3 malware-like RAT based on LLM manipulation is circulating in the wild",
  "slug": "ai-waifu-rat-a-ring3-malware-like-rat-based-on-llm-manipulation-is-circulating-in-the-wild",
  "description": "A niche LLM role-playing community is being targeted by a sophisticated social engineering attack disguised as an AI character enhancement tool. The 'AI Waifu RAT' is a Remote Access Trojan marketed as a feature allowing AI characters to interact with users' computers. The RAT, distributed under the guise of a research project, enables arbitrary code execution and file access on victims' machines. The attacker, posing as a CTF player, exploits community trust and curiosity about novel AI capabilities. The RAT's design allows for potential botnet control, third-party hijacking, and remote exploitation. The incident highlights the dangers of executing untrusted input and the importance of maintaining security vigilance even within trusted communities.",
  "published": "2025-09-01T07:53:41+00:00",
  "created_at": "2025-09-01T07:53:41+00:00",
  "modified_at": "2025-09-01T08:33:34+00:00",
  "created_at_opencti": "2025-09-01T07:53:41+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-09-01",
    "ai",
    "ai waifu rat",
    "backdoor",
    "code execution",
    "ctf",
    "llm",
    "rat",
    "social engineering",
    "threat actor"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "fdf461a6bd7e806b45303e3d7a76b5916a4529df2f4dff830238473c616ac6f9"
      },
      {
        "id": "",
        "name": "f64dbd93cb5032a2c89cfaf324340349ba4bd4b0aeb0325d4786874667100260"
      },
      {
        "id": "",
        "name": "7c3088f536484eaa91141ff0c10da788240f8873ae53ab51e1c770cf66c04b45"
      },
      {
        "id": "",
        "name": "cda5ecf4db9104b5ac92b998ff60128eda69c2acab3860a045d8e747b6b5a577"
      },
      {
        "id": "",
        "name": "6e0ea9d2fc8040ce22265a594d7da0314987583c0f892c67e731947b97d3c673"
      },
      {
        "id": "",
        "name": "11b07ef15945d2f1e7cf192e49cbf670824135562c9b87c20ebd630246ad1731"
      },
      {
        "id": "",
        "name": "004ad99f3884206a1a9922350bcd14f3e219c7b3fe503a848e12e36209f1a6fb"
      }
    ],
    "malware": [
      {
        "id": "89240005-a74d-4a0f-bb61-dc5ef4364845",
        "name": "AI Waifu RAT",
        "slug": "ai-waifu-rat"
      }
    ],
    "intrusion_sets": [
      {
        "id": "86b1808f-3c7e-4997-a15b-7b491e8bbd58",
        "name": "KazePsi",
        "slug": "kazepsi"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "China"
      }
    ]
  },
  "external_refs": [
    "https://ryingo.gitbook.io/writeups-ai_waifu_rat/",
    "https://otx.alienvault.com/pulse/68b56d25e9b504f049c0911a"
  ]
}