Full Story:
Windows Malware Uses Pulsar RAT for Live Chats While Stealing Data
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
hackread.com
Windows Malware Uses Pulsar RAT for Live Chats While Stealing Data
- Thread starter Brownie2019
- Start date
hackread.com
What you quoted matches a primary write-up from Point Wild’s Lat61 Threat Intelligence Team, published on January 29, 2026, and then summarized by Hackread on January 31, 2026. ([pointwild.com](https://www.pointwild.com/threat-intelligence/when-malware-talks-back))Full Story:
Windows Malware Uses Pulsar RAT for Live Chats While Stealing Data
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
What’s notable in this campaign (from the primary report)
The main “interesting” aspect isn’t just the RAT/stealer combo—it’s the operator interaction layer (“malware talks back”) combined with a fairly modern, stealthy execution chain:
- Living-off-the-land + in-memory execution: A batch file persists via a per-user Run key, then uses PowerShell to decrypt and inject Donut-generated shellcode into legitimate processes (fileless-style behavior). ([pointwild.com](https://www.pointwild.com/threat-intelligence/when-malware-talks-back))
- Persistence without admin: The report explicitly calls out HKCU\Software\Microsoft\Windows\CurrentVersion\Run as a persistence mechanism (no elevation required). ([pointwild.com](https://www.pointwild.com/threat-intelligence/when-malware-talks-back))
- Process injection + watchdog behavior: The PowerShell stage injects into common processes (example discussed: explorer.exe) and includes a watchdog loop to re-inject if the target process dies. ([pointwild.com](https://www.pointwild.com/threat-intelligence/when-malware-talks-back))
- Data theft and exfiltration: Stolen data is packaged (ZIP) and exfiltrated using Discord webhooks and Telegram bots per the executive summary. ([pointwild.com](https://www.pointwild.com/threat-intelligence/when-malware-talks-back))
Important naming note (to avoid confusion)
“Pulsar RAT” here is unrelated to “DoublePulsar” (the leaked NSA backdoor often mentioned with EternalBlue/WannaCry). People sometimes mix these up because of the name similarity. ([en.wikipedia.org](https://en.wikipedia.org/wiki/DoublePulsar?utm_source=openai))
Practical takeaways for MalwareTips readers
1) Don’t over-interpret “fileless = undetectable”
In-memory techniques can reduce classic on-disk signatures, but many modern security products can still catch this via behavior (PowerShell abuse, injection, unusual child processes, C2 patterns). It’s more accurate to say “harder to catch with basic/static-only approaches,” not “impossible.” ([pointwild.com](https://www.pointwild.com/threat-intelligence/when-malware-talks-back))
2) If someone suspects they’re hit by something like this
Low-risk, standard incident-response steps:
- Disconnect from the network (stop further theft/control).
- From a known-clean device: change key passwords (email first), revoke sessions/tokens where possible, and enable MFA (ideally authenticator app/hardware key).
- Run reputable scans (example approach): Windows Defender Offline scan + a second-opinion scanner (ESET Online Scanner / Malwarebytes).
- Check persistence locations with reputable sysadmin tools (Autoruns is commonly used for HKCU Run entries).
- If data theft is suspected (browser sessions, crypto wallets, Steam/Discord, etc.), assume credentials/tokens may be compromised and rotate them accordingly.
If system integrity is in doubt (especially with RAT-like control and credential theft), a clean OS reinstall with password rotation from a clean machine is often the most reliable way to return to a trusted state.
3) For defenders/admins
Focus on reducing the attack surface abused in the chain described by Point Wild:
- Harden PowerShell (logging, constrained language where feasible, block/limit unsigned scripts).
- Enable and tune Defender protections (cloud-delivered protection, Tamper Protection, Attack Surface Reduction rules where appropriate).
- Limit LOLBins abuse (AppLocker/WDAC/SRP for script hosts where feasible).
- Monitor for suspicious HKCU Run entries and PowerShell spawning patterns that inject into explorer.exe.
Sources
Concerning case of Pulsar RAT with its “live chat” while stealing data… almost feels like customer support, but in thief mode 
.
From what I understand, these threats leverage PowerShell and run in memory, with persistence in HKEY_CURRENT_USER and exfiltration via Discord/Telegram.
@Andy Ful , do you think the hardening applied by Hard_Configurator (especially the PowerShell restrictions and the strengthened Windows Firewall) could make it harder for this kind of RAT to execute or communicate?
I mention this because, while Comodo’s sandbox helps to contain the browser (thanks @ErzCrz for showing me how to run browsers this way), I’m not sure if that would be effective in this case. My impression is that Hard_Configurator could add another interesting defensive layer. Do you see it as a viable brake, or would this malware still have room to maneuver?
.From what I understand, these threats leverage PowerShell and run in memory, with persistence in HKEY_CURRENT_USER and exfiltration via Discord/Telegram.
@Andy Ful , do you think the hardening applied by Hard_Configurator (especially the PowerShell restrictions and the strengthened Windows Firewall) could make it harder for this kind of RAT to execute or communicate?
I mention this because, while Comodo’s sandbox helps to contain the browser (thanks @ErzCrz for showing me how to run browsers this way), I’m not sure if that would be effective in this case. My impression is that Hard_Configurator could add another interesting defensive layer. Do you see it as a viable brake, or would this malware still have room to maneuver?
While I'm certainly not Andy I can address this. Based on the technical details of the Pulsar RAT campaign found in the provided reports, the hardening measures applied by Hard_Configurator (H_C) would likely completely neutralize this attack chain before the RAT could establish a connection or launch the "Live Chat."Concerning case of Pulsar RAT with its “live chat” while stealing data… almost feels like customer support, but in thief mode
From what I understand, these threats leverage PowerShell and run in memory, with persistence in HKEY_CURRENT_USER and exfiltration via Discord/Telegram.
@Andy Ful , do you think the hardening applied by Hard_Configurator (especially the PowerShell restrictions and the strengthened Windows Firewall) could make it harder for this kind of RAT to execute or communicate?
I mention this because, while Comodo’s sandbox helps to contain the browser (thanks @ErzCrz for showing me how to run browsers this way), I’m not sure if that would be effective in this case. My impression is that Hard_Configurator could add another interesting defensive layer. Do you see it as a viable brake, or would this malware still have room to maneuver?
Kill Step 1
By default, H_C configures Windows to block the execution of all scripts (.bat, .cmd, .vbs, .ps1) and executables located in user-writable directories like %APPDATA% and %TEMP%.
The Windows OS would refuse to run the 0a1a98b5f9fc7c62.bat file immediately upon double-click or system trigger, displaying a "This program is blocked by group policy" message. The attack fails at step zero.
Kill Step 2
The malware "hijacks the computer’s own trusted tools, like PowerShell, to run its code entirely in the system’s memory. H_C typically enforces Constrained Language Mode (CLM) for PowerShell or blocks powershell.exe execution entirely for standard users. Even if the batch file somehow executed, the subsequent call to PowerShell would fail. In Constrained Language Mode, the complex .NET reflection required to load the "Donut" shellcode generator and perform memory injection is strictly prohibited.
Kill Step 3
The malware needs to communicate with discord.com/api and api.telegram.org to receive commands and exfiltrate data (passwords, cookies, crypto wallets). The "Strengthened Windows Firewall" (often using the Recommended H_C Firewall Rules) creates block rules for "LOLBins" (Living Off The Land Binaries). This explicitly blocks powershell.exe, wscript.exe, and cscript.exe from making any outbound network connections. Even if the PowerShell script ran (bypassing SRP), it would be unable to download the secondary payload (Stealerv37) or send the initial "check-in" beacon to the attacker's Discord webhook.
The malware attempts to inject code into explorer.exe. explorer.exe is a trusted Windows process and is almost always allowed through firewalls to let the user browse the web. If the malware successfully injects into explorer.exe, the firewall might allow the traffic because it appears to come from a trusted process. This highlights why the SRP (Batch file block) and PowerShell restrictions are the most critical layers. They prevent the injection from ever happening. Relying on the firewall alone might be risky if the injection succeeds, but the full H_C suite stops the injection at the source.
Last edited:
Thank you for such a clear explanation
. Every contribution I receive in these threads feels like a gift, because it always helps me broaden my understanding and learn nuances I might otherwise miss. I truly value your input and welcome it with gratitude, as it enriches the exchange and strengthens the community. 
Yes:
- The initial batch file will be blocked.
- If not, the dropped PowerShell script will be blocked.
- If not, the payload will not be decoded due to PowerShell Constrained Language Mode.
- If not, the shellcode will not be injected into Explorer due to PowerShell Constrained Language Mode.
I mention this because, while Comodo’s sandbox helps to contain the browser (thanks @ErzCrz for showing me how to run browsers this way), I’m not sure if that would be effective in this case. My impression is that Hard_Configurator could add another interesting defensive layer. Do you see it as a viable brake, or would this malware still have room to maneuver?
Comodo can block the attack if properly configured (via the Script Analysis feature). The batch and PowerShell scripts will be contained.
Last edited:
Thank you very much, @Andy Ful
. Your explanation gives me a very clear view of how Hard_Configurator acts step by step against this type of threat. For me, it is extremely valuable to have the direct perspective of the tool’s developer (without diminishing @Divergent ’s detailed contribution), because it turns theory into something practical and trustworthy. I truly appreciate you sharing this knowledge with the community, as it helps us better understand the defenses and feel more confident when applying them. 
I doesn't say in what circumstances you would end up chatting to these people, does it hijack other chat modules?? It does seem you have to be the bluntest knife in the drawer to get into this situation??
Says starts with a file in AppData folder; not explaining how it reached there at the first place.
What edjit would engage in any live chat if such appeared? Don't engage, image back, format, switch router off whatever surely?? Its our thinking ability that needs hardening here it seems?
Storm in a tea cup??
Storm in a tea cup??
The simplest missing part:
Chat, Forum discussions, Phishing, etc. ---> download ZIP archive with embedded shortcut (PDF icon) + hidden .bat + .pdf
The user can see only something that looks like a PDF document. After opening, the shortcut runs the .bat file, which opens a benign .pdf, copies itself to %AppData%\Microsoft, adds persistence via the registry Run key, and infects the system.
Last edited:
The "Live Chat" Feature
You asked if the "Live Chat" implies a hijack of your own tools. It does not; it is a built-in feature of the RAT itself used for direct interaction by the attacker.
Source
Point Wild & ThreatMon
Evidence
Technical reports on Pulsar RAT (and its predecessor Quasar RAT) confirm it includes a "Remote Control with Live Chat" module. This is a custom window the attacker opens on your desktop to communicate with you (often for extortion), rather than a hijack of your WhatsApp or Slack.
Link: Point Wild: When Malware Talks Back
Hijacking Discord & Telegram (Token Stealing)
You asked if it hijacks other modules. Yes, it specifically targets session "tokens" to bypass passwords.
Source
VirusTotal & ThreatMon
Evidence
Analysis of the "Stealerv37" payload (often used with Pulsar) shows it targeting discord.com/api and api.telegram.org. It uses the "Kematian Stealer" module to extract authentication tokens from these apps, allowing attackers to log in as you without needing your password or 2FA.
Link: ThreatMon: Understanding Pulsar RAT
The "Bluntest Knife" (Social Engineering)
You questioned about needing to be "stupid" to get infected. Recent campaigns prove this false by targeting technical experts.
Source
SC Media & The Hacker News
Evidence
A recent campaign found Pulsar RAT hidden inside complex, obfuscated npm and PyPI packages (coding libraries). Developers who simply typed npm install [package-name] to do their job were instantly infected. This proves that infection often comes from "trusted" technical workflows, not just "clicking dumb links."
Link: SC Media: Complex npm attack uses 7-plus layers of obfuscation to spread Pulsar RAT
You asked if the "Live Chat" implies a hijack of your own tools. It does not; it is a built-in feature of the RAT itself used for direct interaction by the attacker.
Source
Point Wild & ThreatMon
Evidence
Technical reports on Pulsar RAT (and its predecessor Quasar RAT) confirm it includes a "Remote Control with Live Chat" module. This is a custom window the attacker opens on your desktop to communicate with you (often for extortion), rather than a hijack of your WhatsApp or Slack.
Link: Point Wild: When Malware Talks Back
Hijacking Discord & Telegram (Token Stealing)
You asked if it hijacks other modules. Yes, it specifically targets session "tokens" to bypass passwords.
Source
VirusTotal & ThreatMon
Evidence
Analysis of the "Stealerv37" payload (often used with Pulsar) shows it targeting discord.com/api and api.telegram.org. It uses the "Kematian Stealer" module to extract authentication tokens from these apps, allowing attackers to log in as you without needing your password or 2FA.
Link: ThreatMon: Understanding Pulsar RAT
The "Bluntest Knife" (Social Engineering)
You questioned about needing to be "stupid" to get infected. Recent campaigns prove this false by targeting technical experts.
Source
SC Media & The Hacker News
Evidence
A recent campaign found Pulsar RAT hidden inside complex, obfuscated npm and PyPI packages (coding libraries). Developers who simply typed npm install [package-name] to do their job were instantly infected. This proves that infection often comes from "trusted" technical workflows, not just "clicking dumb links."
Link: SC Media: Complex npm attack uses 7-plus layers of obfuscation to spread Pulsar RAT
You may also like...
-
New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse- Started by Brownie2019
- Replies: 1
-
Hackers Are Using Shared AI Chats to Steal Your Passwords and Crypto
- Started by Brownie2019
- Replies: 5
-
Malicious Chrome Extension Steal ChatGPT and DeepSeek Conversations from 900K Users
- Started by Brownie2019
- Replies: 2
-
New HyperRat Android Malware Sold as Ready-Made Spy Tool
- Started by Brownie2019
- Replies: 1
-
Malicious zip files use Windows Shortcuts to drop malware
- Started by Brownie2019
- Replies: 29