RATs and Loaders With Stealer Modules: How Remote Access and Malware Delivery Tools Power Credential Theft

Remote access trojans and loaders occupy a different place in the infostealer ecosystem. They are often not pure stealers. Their core purpose is usually remote control, persistence, payload delivery, reconnaissance, or malware staging. Yet in real-world incidents, they frequently create the same outcome as dedicated infostealers: stolen credentials, stolen browser data, stolen cookies, stolen crypto wallets, stolen files, and exposed enterprise access.

This group includes tools such as Remcos, AsyncRAT, QuasarRAT, NanoCore, NetWire, njRAT, Ave Maria or Warzone RAT, Amadey, SmokeLoader, PrivateLoader, DarkGate, HijackLoader, MintsLoader, and other malware families that either include stealer functionality directly or deliver dedicated stealers as follow-on payloads. Some are remote access tools abused by criminals. Some are open-source RATs modified for malicious use. Some are commercial or underground malware products. Some are loaders whose main value is their ability to install whatever malware the operator chooses next.

The key difference is control. A classic stealer usually runs, collects data, exfiltrates it, and exits. A RAT gives the attacker a live foothold on the machine. A loader gives the attacker a delivery channel. Once the attacker has either remote control or a payload delivery mechanism, credential theft becomes one of several possible outcomes. The attacker can steal credentials directly, deploy a stealer, install a keylogger, dump browser data, capture screenshots, search for wallet files, deploy ransomware, or sell access to another criminal group.

This is why RATs and loaders should be included in any serious infostealer series. They are part of the same criminal supply chain. Red Canary describes a modern stealer delivery ecosystem where paste-and-run lures and other campaigns deliver loaders or crypters that then drop stealers, with HijackLoader, MintsLoader, and CypherIT appearing as high-volume threats involved in stealer delivery.

What makes this group different

RATs and loaders are best understood as infrastructure malware. They give attackers options. A pure stealer produces a stolen log. A RAT produces access. A loader produces payload flexibility. That flexibility makes these tools valuable across many types of cybercrime.

A remote access trojan gives the operator interactive control over a compromised endpoint. Depending on the family and configuration, the attacker may be able to browse files, run commands, capture keystrokes, view the screen, use the webcam or microphone, steal browser credentials, upload and download files, collect system information, install additional payloads, and maintain persistence. This turns one infected endpoint into a managed asset.

A loader is different. Its main function is to deliver malware. The first payload may be small, obfuscated, and designed to survive initial detection. It then downloads, decrypts, injects, or launches the second-stage payload. That payload may be an infostealer, RAT, ransomware precursor, banking trojan, proxyware tool, cryptominer, or another loader. Microsoft’s description of Trojan:JS/AsyncRAT shows this staged model clearly: the JavaScript component functions as an initial loader in a multi-phase attack and downloads, decrypts, and installs the final AsyncRAT payload on a Windows device.

The practical difference for defenders is important. With a pure infostealer, the response focuses on stolen data and identity exposure. With a RAT or loader, the response must also address persistence, remote control, follow-on payloads, lateral movement, additional malware, and possible ransomware staging. The endpoint infection may be only the first step in a longer intrusion.

RATs as stealer platforms

Remote access trojans often include stealer features because credential theft is a natural part of remote access. Once the attacker controls a machine, the machine becomes a source of passwords, cookies, files, screenshots, tokens, and user activity. Many RATs include built-in keylogging, browser credential theft, clipboard capture, file browsing, screen capture, and command execution. Others support plugins that add those features.

Remcos is a good example. It is commonly described as a remote access tool that threat actors abuse as a RAT. Recent reporting describes Remcos as providing credential theft, keylogging, screen capture, webcam and microphone control, and persistent command-and-control access. Elastic’s research also described Remcos as a widespread 2024 malware family and analyzed its configuration loading and execution flow, including browser-related cleanup behavior.

AsyncRAT is another important example. It is a .NET-based remote access trojan that is frequently delivered through phishing, script chains, cloud storage links, and loader-style infection flows. Microsoft describes AsyncRAT delivery as a multi-stage attack in which a JavaScript loader installs the final RAT payload. Check Point reported that AsyncRAT appeared as the fourth most prevalent malware in its February 2025 threat index and described it as enabling data theft, command execution, and system compromise.

This makes AsyncRAT relevant to infostealer analysis even when a specific campaign uses it as a RAT rather than a dedicated stealer. The operator can use it to steal credentials, deploy additional tooling, search for wallets, capture keystrokes, or move further into the environment. The same is true for QuasarRAT, NanoCore, NetWire, njRAT, Ave Maria or Warzone RAT, BitRAT, and similar tools. Their core value is access, and access enables theft.

Loaders as stealer delivery systems

Loaders are one of the main reasons infostealers spread so widely. A loader turns an initial infection into a marketplace for payloads. The same loader can deliver RedLine today, Lumma tomorrow, Rhadamanthys next week, and ransomware-related tooling after that. This gives operators flexibility and allows malware distributors to sell installations to different buyers.

The loader ecosystem is especially important for commodity stealers. Many victims do not download a stealer directly. They run a fake installer, fake crack, fake update, malicious script, or phishing attachment that launches a loader. The loader then retrieves the stealer from attacker infrastructure. This separates delivery from theft. The first-stage operator specializes in infection. The second-stage operator specializes in monetization.

Red Canary’s 2025 reporting makes this relationship clear by describing paste-and-run lures that deliver loaders or crypters, which then drop stealers. It specifically names HijackLoader, MintsLoader, and CypherIT as part of the stealer delivery ecosystem.

QakBot is a useful historical example of how a malware family can move from banking trojan to loader and broader criminal platform. CISA states that QakBot originally operated as a banking trojan used to steal banking credentials, then evolved into a botnet and malware variant capable of reconnaissance, lateral movement, data exfiltration, and ransomware delivery. CISA also warned that disruption of QakBot infrastructure did not remove other malware or ransomware already installed on victim computers, which is exactly the risk created by loader-style malware.

Why RATs and loaders matter in an infostealer series

RATs and loaders matter because infostealer incidents often start with them or expand through them. A user may run a malicious file that installs a loader. The loader may deploy a stealer. The stealer may collect browser sessions and credentials. The attacker may then use those credentials for account takeover. Another actor may buy the stolen log and use it for ransomware access. In this chain, the loader is as important as the stealer itself.

A RAT can create a similar chain. The victim opens a phishing attachment that installs AsyncRAT, Remcos, or another remote access trojan. The attacker uses the RAT to collect credentials, deploy an infostealer, capture screenshots, search for files, or install a second-stage payload. The original malware may appear to be “remote access,” but the outcome is credential theft and identity compromise.

This distinction is important for security teams and business leaders. Malware categories are useful for analysis, but attackers care about outcomes. If a RAT steals browser credentials, it functions as a stealer. If a loader delivers Lumma or RedLine, it is part of the infostealer operation. If a banking trojan deploys ransomware, it becomes part of the ransomware chain. The same tool can play different roles in different campaigns.

Major RATs and loaders with stealer relevance

Remcos is one of the most common RATs abused in credential theft and surveillance campaigns. It is often delivered through phishing emails with malicious attachments disguised as invoices, purchase orders, job documents, tax forms, or government notices. Once installed, it can provide remote control, keylogging, screen capture, credential theft, webcam access, microphone access, file transfer, and persistence. Its broad feature set makes it useful for both low-level cybercrime and more targeted intrusions.

AsyncRAT is a widely used open-source RAT family that has become popular because it is accessible, flexible, and easy to modify. It is commonly delivered through multi-stage script chains, phishing emails, malicious cloud storage links, LNK files, JavaScript, BAT files, and Python-based loaders. Microsoft describes a JavaScript-based AsyncRAT loader that downloads, decrypts, and installs the final .NET RAT payload. Check Point reported that AsyncRAT campaigns used trusted platforms such as Dropbox links, TryCloudflare tunnels, malicious Python packages, and multi-step infection chains.

QuasarRAT is another open-source remote administration tool frequently abused by threat actors. It offers remote desktop, file management, keylogging, credential access through plugins or modifications, command execution, and persistence. Like AsyncRAT, its public availability makes it attractive to a wide range of operators. Its significance comes from flexibility rather than a single dedicated stealer module.

NanoCore is a long-running RAT family associated with remote control, credential theft, keylogging, webcam access, file management, and plugin-based capability expansion. It has appeared in many phishing-driven campaigns and has been widely used by commodity actors. Its plugin model helped make it adaptable for theft, surveillance, and follow-on payload delivery.

NetWire is a remote access trojan used for credential theft, keylogging, file theft, and remote control. It has appeared in phishing campaigns against businesses, government targets, and individuals. Its value is the same as other RATs in this category: it gives the attacker interactive access and the ability to collect sensitive data from the endpoint.

njRAT, also known as Bladabindi, is a long-running RAT widely used in commodity campaigns. It supports remote command execution, keylogging, file access, screen capture, process control, and persistence. It has been used by lower-tier criminals and more organized actors, often delivered through phishing, cracked software, malicious archives, and social engineering.

Ave Maria, also known as Warzone RAT, is another remote access trojan with credential theft, keylogging, screen capture, file management, and remote control capabilities. It has been sold in underground markets and used in phishing campaigns. Its relevance to an infostealer series comes from its credential collection and live access features.

Amadey is best understood as a bot and loader with information-gathering and payload delivery capabilities. It is commonly used to deliver additional malware, including stealers. Its operators can use it to profile infected systems, download payloads, and maintain a lightweight foothold. In the infostealer economy, Amadey is often part of the delivery layer.

SmokeLoader is a long-running loader used to deliver a variety of payloads. It has been associated with credential theft, additional malware deployment, and modular criminal operations. As with many loaders, its threat depends heavily on the payloads it delivers. A SmokeLoader infection can become a stealer incident, a botnet incident, or a ransomware precursor depending on the operator.

PrivateLoader is a pay-per-install loader frequently associated with fake software, cracked applications, and malware distribution. It has been used to deliver stealers and other commodity malware. Its role is important because it shows how stealer infections can originate from traffic distribution systems and underground install markets rather than direct stealer campaigns.

DarkGate is a loader and remote access malware family used in phishing, Teams abuse, malvertising, and fake software campaigns. It can support command execution, remote control, payload delivery, and credential-related activity. Its importance comes from its use as a flexible delivery and access platform.

HijackLoader is a major modern loader family. Red Canary identified it as part of the stealer delivery ecosystem and noted that it appeared in high volume in the same landscape as paste-and-run lures and other stealer delivery methods. HijackLoader matters because it represents the modern loader model: stealthy first-stage execution, payload flexibility, and frequent use in campaigns that ultimately deliver stealers.

MintsLoader and CypherIT also belong in this delivery layer. Red Canary identifies both as part of the stealer delivery ecosystem. MintsLoader functions as a loader, while CypherIT is more closely associated with crypter and loader-style evasion. Both matter because they support the broader process of getting stealers onto victim machines and helping payloads avoid detection.

Comparison table: RATs and loaders with stealer relevance

This comparison table treats families by operational role. That matters because the same tool may behave differently depending on the campaign. AsyncRAT may be used for remote access in one incident and credential theft in another. Amadey may profile a machine and then deliver a stealer. QakBot may steal data, move laterally, and deliver ransomware. The practical question is not only what the malware is called, but what it enables.

How RAT and loader infections usually start

Most RAT and loader infections begin with social engineering. The victim opens a file, runs a script, clicks a link, installs a fake tool, or follows a fake support instruction. Phishing remains a major delivery method, especially for RATs such as Remcos, AsyncRAT, NetWire, NanoCore, njRAT, and Ave Maria. The lure may be a purchase order, invoice, resume, shipment notice, tax document, legal notice, bank message, or business request.

Script-based delivery is common. A malicious email or website may deliver a JavaScript file, LNK shortcut, BAT file, PowerShell command, VBS script, HTA file, or archive containing a staged payload. These scripts often download the next stage from cloud storage, compromised websites, attacker servers, or tunneling services. Microsoft’s AsyncRAT description shows the staged model, where the JavaScript loader initiates an obfuscated sequence that installs the final RAT.

Fake software and cracked applications are common for loaders. A user searching for a free version of software, a game cheat, an activation tool, or a productivity utility may download a loader instead. The loader can then install a stealer, RAT, adware, proxyware, miner, or ransomware precursor. This is one of the main ways private install markets feed the infostealer economy.

Trusted-platform abuse is also common. Attackers use cloud storage links, collaboration platforms, remote monitoring tools, tunneling services, and legitimate software to make delivery look normal. Check Point reported an AsyncRAT campaign using Dropbox URLs, TryCloudflare tunnels, malicious Python packages, and a multi-step chain involving LNK, JavaScript, and BAT files.

How these tools steal data

RATs and loaders steal data through several paths. A RAT may include native stealer features such as keylogging, browser credential extraction, clipboard capture, screenshot capture, file browsing, webcam access, and command execution. The operator can manually search the machine for interesting data or automate collection through scripts and plugins.

A loader usually steals data indirectly by delivering a dedicated stealer. The loader profiles the machine, checks the environment, retrieves payloads, and executes them. The stealer then collects browser data, cookies, wallets, files, and credentials. In many incidents, the victim and defender may first see the loader, while the actual data theft occurs through a later payload.

Some tools do both. A malware family may act as a loader, RAT, and stealer depending on configuration. It may collect basic system information, install persistence, receive commands, and download modules. This blended model is common because it gives operators flexibility and makes classification harder.

The stolen data usually follows the same value hierarchy as pure infostealers. Browser credentials and cookies are highly valuable. Crypto wallets provide immediate financial opportunity. Email accounts support business email compromise and phishing. VPN credentials and SSO sessions create enterprise access. Developer secrets such as SSH keys, GitHub tokens, cloud credentials, and environment files can create supply-chain and cloud risk.

Why remote access increases business risk

A pure stealer is dangerous because data leaves the device quickly. A RAT is dangerous because the attacker can stay, observe, and adapt. Remote access allows the operator to make decisions based on what they find. They can search for finance documents, password files, browser sessions, wallet software, VPN tools, remote desktop clients, cloud CLI files, and internal applications. They can deploy different tools depending on the victim’s value.

This makes RAT infections especially concerning for businesses. A finance employee’s workstation may lead to invoice fraud or payment manipulation. A developer’s workstation may expose source code and secrets. An executive’s machine may expose email, board documents, customer data, and SaaS sessions. An IT administrator’s machine may expose privileged access.

RATs also support longer dwell time. The attacker can wait for the user to log in to a bank, cloud platform, or corporate application. They can capture keystrokes, screenshots, and session data as it appears. They can install additional payloads after initial discovery. This makes the incident more dynamic than a one-time grab.

Why loaders increase investigation scope

A loader infection should always expand the investigation scope. The loader’s job is to install other malware, so defenders need to determine what else ran on the system. Removing the loader binary may leave behind a stealer, RAT, ransomware precursor, persistence mechanism, scheduled task, injected process, or stolen credentials.

CISA’s QakBot advisory makes this point directly in the context of botnet disruption. It states that disruption of QakBot infrastructure does not mitigate other malware or ransomware previously installed on victim computers. That principle applies broadly to loader incidents. A first-stage malware detection is often only the visible part of the chain.

Loaders also complicate attribution and remediation. The same loader can deliver different payloads to different victims based on geography, system profile, operator, time, or campaign. One organization may receive a stealer. Another may receive a RAT. A third may receive ransomware staging tools. The loader family gives context, but the payload history determines impact.

Enterprise impact

The enterprise impact of RATs and loaders with stealer modules can be severe. These tools can expose credentials, enable account takeover, deliver ransomware, support business email compromise, steal data, and create unauthorized remote access. They can also act as the first step in a multi-stage intrusion.

Credential theft is the most immediate risk. Browser passwords, cookies, VPN credentials, email credentials, FTP credentials, SSH keys, cloud tokens, password manager artifacts, and application secrets may all be exposed. Even when the RAT itself does not automatically extract all of these items, the operator can use remote access to collect them manually or deploy a dedicated stealer.

Ransomware enablement is the next major risk. Loaders and botnets have historically played a key role in ransomware delivery. QakBot’s evolution from banking trojan to botnet with ransomware delivery capability is one of the clearest examples. CISA describes QakBot as evolving to include reconnaissance, lateral movement, data exfiltration, and ransomware delivery.

Business email compromise is another common outcome. A RAT or loader infection on an employee device can expose email sessions, credentials, contacts, invoices, and payment conversations. Attackers can then impersonate the user, alter payment instructions, or use the account for phishing.

Cloud and developer compromise are also important. If the victim is a developer, engineer, administrator, or DevOps user, the machine may contain cloud credentials, repository access, SSH keys, Kubernetes configs, package registry tokens, local secrets, and deployment tools. A RAT gives attackers time to search for these assets. A loader gives them the ability to install tools designed to collect them.

Detection opportunities

Detection should focus on both first-stage behavior and follow-on activity. For RATs, defenders should look for suspicious remote access behavior, keylogging indicators, screenshot capture, unusual child processes, persistence mechanisms, C2 beaconing, unexpected file transfer, and command execution from user-writable paths. Network connections to unusual hosts, tunneling services, dynamic DNS, newly registered domains, and uncommon ports can also provide useful signals.

For loaders, detection should focus on staged execution. Common signals include scripts downloading executables, encoded PowerShell, JavaScript launching command interpreters, LNK files starting script chains, BAT files writing payloads, suspicious archive extraction, process injection, DLL side-loading, and new persistence shortly after user-driven execution. The payload that appears after the loader is often the most important evidence.

Endpoint telemetry should be correlated with identity telemetry. A RAT or loader infection followed by new logins, unusual session activity, mailbox rule creation, VPN access, cloud console access, or suspicious OAuth grants should be treated as a possible identity compromise. The malware may have collected credentials before the endpoint alert fired.

Browser and file access telemetry can help identify stealer behavior. Processes that rapidly read browser profile folders, cookie databases, password stores, wallet extension folders, Telegram or Discord data, FTP client profiles, and cloud credential directories deserve attention. Many RATs and loaders become infostealer incidents when these behaviors appear.

Prevention priorities

The strongest prevention starts with reducing initial execution. Email security, attachment controls, URL filtering, sandboxing, and user training reduce phishing-driven RAT delivery. Application control and managed software catalogs reduce fake installer and cracked software infections. Script controls reduce the risk from JavaScript, VBS, PowerShell, BAT, HTA, and LNK-based chains.

Endpoint protection should include behavior-based detection, not only signatures. RATs and loaders change frequently, and many campaigns use obfuscation, packing, staged payloads, and trusted-platform abuse. Behavior such as suspicious script execution, credential store access, injection, persistence, and C2 communication is often more durable than file hashes.

Identity controls reduce damage after credential theft. Phishing-resistant MFA, conditional access, device compliance, session monitoring, token revocation, and least privilege make stolen credentials harder to use. Since RATs can capture active activity and loaders can deploy stealers, password resets alone provide limited coverage without session and token review.

Network segmentation and least privilege help contain follow-on activity. If a loader deploys ransomware-related tooling or a RAT operator attempts lateral movement, segmentation can limit spread. Administrative access should be carefully controlled because RATs on privileged workstations create much larger blast radius.

Developer and cloud environments need special controls. Secrets should be short-lived where possible, scoped tightly, monitored, and rotated quickly when compromise is suspected. Local storage of production secrets should be minimized. Cloud access should require device trust and strong authentication.

Response and remediation

A RAT or loader incident should be treated as a potential multi-stage compromise. The first step is containment. The affected host should be isolated, and responders should preserve evidence where possible. The team should identify the malware family, execution chain, persistence, network connections, payloads, user account activity, and timeline.

For RATs, responders should assume the attacker may have interacted with the machine. This means reviewing files accessed, commands executed, screenshots captured, credentials exposed, and additional payloads installed. A rebuild is often safer than simple removal when remote access, persistence, or credential theft is confirmed.

For loaders, responders should determine every payload delivered. This requires timeline analysis, process tree review, network logs, dropped files, memory artifacts, scheduled tasks, registry changes, startup entries, and endpoint alerts. The loader itself is only one part of the event.

Credential response is essential. Passwords should be reset, active sessions revoked, OAuth grants reviewed, MFA settings checked, mailbox rules inspected, VPN access reviewed, cloud tokens rotated, SSH keys replaced, and developer secrets rotated where relevant. If browser cookies or session data were likely stolen, session revocation becomes as important as password reset.

The organization should also look for lateral movement and follow-on activity. This includes unusual remote access, new admin accounts, suspicious service creation, remote scheduled tasks, credential dumping, unusual PowerShell, SMB activity, RDP activity, data staging, and ransomware indicators. RATs and loaders often sit at the beginning of longer intrusion chains.

Comparison framework for RATs and loaders with stealer modules

The best way to compare this group is to evaluate each family by access capability, payload flexibility, theft capability, persistence, evasion, and downstream impact.

This framework helps separate a simple RAT from a full intrusion platform. It also helps explain why a loader that never steals credentials directly can still be critical to infostealer risk. If it reliably delivers stealers, it belongs in the same threat model.

How this group fits into the broader infostealer economy

RATs and loaders are the connective tissue of cybercrime. They connect social engineering to credential theft. They connect initial access to payload delivery. They connect endpoint compromise to ransomware, fraud, and account takeover. A pure stealer may be the visible payload, but the loader or RAT often determines how the infection starts, persists, and expands.

This group also shows why defenders should think in attack chains rather than malware labels. A campaign may start with a fake CAPTCHA or phishing email, run a script, install a loader, deliver a RAT, deploy a stealer, exfiltrate credentials, and later result in ransomware or business email compromise. Each malware family has a role, but the business impact comes from the chain.

The rise of paste-and-run lures, trusted-platform abuse, cloud-hosted payloads, and modular malware has made this group more important. Attackers increasingly combine simple user instructions with sophisticated payload delivery. Red Canary’s reporting on loaders and crypters delivering stealers captures this shift clearly.

Conclusion

RATs and loaders with stealer modules are a major part of the infostealer ecosystem because they enable theft, access, and follow-on compromise. Remcos, AsyncRAT, QuasarRAT, NanoCore, NetWire, njRAT, Ave Maria, Amadey, SmokeLoader, PrivateLoader, DarkGate, HijackLoader, MintsLoader, CypherIT, and QakBot all show how remote control and payload delivery intersect with credential theft.

Some of these tools steal data directly through keylogging, browser credential extraction, screenshots, and file access. Others deliver dedicated stealers as second-stage payloads. Some do both. The common theme is flexibility. A RAT gives the attacker control. A loader gives the attacker options. Both can turn a single endpoint infection into identity compromise, business email compromise, cloud exposure, ransomware access, or broader enterprise intrusion.

For defenders, the key lesson is clear. Treat RAT and loader detections as potential infostealer incidents and potential multi-stage intrusions. The response should include endpoint containment, payload hunting, persistence removal, credential rotation, session revocation, identity review, cloud and developer-secret checks, and investigation for lateral movement. In the modern cybercrime economy, the malware that delivers the stealer can be just as important as the stealer itself.