WebRTC Spycam RAT (provisional)
Malware family · 2 sample(s) · 2 indicator record(s) · 1 signing certificate(s) · Active 2026-10-05 → 2026-10-08 (experimental)
About WebRTC Spycam RAT (provisional)
Android surveillance RAT that turns the device into a live spycam. It uses WebRTC to stream the camera and microphone in real time to the operator, signalling/controlled via its C2 at 190.102.41.210. Family label provisional.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| 190.102.41.210:5000 | ip | 7b81db06097e… | 2026-10-05 |
| 190.102.41.210:5000 | ip | 8434cf47a5a1… | 2026-10-08 |
Operators / owners (2)
Operator handles recovered from sample configuration (for example the owner_username baked into the C2 panel). Click to list that operator's indicators.