By 
Kaspersky has revealed the discovery of GriffithRAT – a new and highly sophisticated malware used in campaigns targeting fintech companies, online trading platforms, and betting firms worldwide, including the UAE, Egypt, Türkiye, and South Africa.
Distributed via Skype and Telegram channels, GriffithRAT is typically disguised as files containing financial trend analysis or investment advice.
These deceptive tactics target both organizations and individual traders who unknowingly download the malware, according to IT News.
Once downloaded, it enables attackers to steal login credentials, capture screenshots/webcam streams, log keystrokes, and monitor user activity.
The stolen data can be exploited in a variety of ways, ranging from gathering competitive business intelligence to tracking individuals or valuable assets, highlighting the broad potential for misuse.
Threat actors are contracted by third parties to conduct targeted attacks, often driven by motives such as corporate espionage.
This connection is reinforced by technical analysis, which shows strong similarities between GriffithRAT and DarkMe intrusions.
GriffithRAT is a known remote access Trojan (RAT) commonly used in mercenary-led cyber campaigns.
“This discovery highlights the growing sophistication and commercialization of cyberthreats,” said Maher Yamout, Lead Security Researcher at Kaspersky.
“GriffithRAT is not the work of random hackers; it is a maintained piece of malware and part of a broader trend where cyber mercenaries are hired to collect sensitive information, often for financial or strategic advantage.
“The data harvested could offer visibility into the inner workings of major organizations, provide unethical competitive advantage, and may also be sold on the dark web.
“It is a reminder that in today’s threat landscape, cybercrime is increasingly professional, targeted, and persistent,” the report noted.
WARNING! All rights reserved. This material, and other digital content on this website, may not be reproduced, published, broadcast, rewritten or redistributed in whole or in part without prior express permission from ZAMBIA MONITOR.
Comments