Experts from the Solar 4RAYS center at Solar Group have identified an updated version of the Webrat stealer, also known as Salat Stealer. The malware now utilizes the TON blockchain network to retrieve the addresses of its command-and-control servers, making it significantly harder to neutralize.
The malware is typically distributed disguised as game cheats, pirated software, or modified clients for blocked services. Once installed, it steals credentials for platforms like Steam and Telegram, accesses crypto wallets, and can grant attackers full control over the infected machine, including the ability to deploy miners or ransomware.
By employing a technique known as Blockchain Dead Drop, the malware avoids traditional detection methods like DNS query monitoring. Instead, it queries the TON blockchain to fetch the current IP address of the control server, which attackers update via smart contracts. This traffic appears legitimate, mimicking standard blockchain interactions.
According to Vasily Shtyrkov, a malware analyst at Solar 4RAYS, the updated Webrat was first spotted on VirusTotal in late summer 2026. The use of TON's programmable smart contracts allows attackers to maintain persistent control over infected systems, as the infrastructure cannot be easily blocked by security solutions.
