At Perennial Edge, part of our role is protecting more than just your portfolio—we’re also watching for threats to your personal financial safety. A new wave of scams involves remote access tools (RATs)—software that lets someone access and control your computer from another location. While RATs are used legitimately in tech support, scammers are now exploiting them to steal money and personal information.
RAT scams are particularly dangerous because they are versatile and difficult to detect. Unlike many other scams, RAT-based cyber-attacks do not require interaction with a scammer or taking action to download malicious software. Moreover, they involve a device that is trusted by the victim and often use legitimate applications that may not show up in antivirus/malware scans.
How a RAT cyber-scam works:
First, the fraudster sends a phishing email or text with a link or attachment that appears legitimate. The email/text may appear to be from a trusted source, such as:
- a financial institution or bank fraud department,
- tech support from Microsoft, Apple, Amazon or even your employer, or
- the IRS or a local utility company.
The email/text may be well-written, sound urgent and/or convincing, and may ask the user to:
- click a link or download a harmless-looking app,
- verify account information, or
- approve a “security update” or “identity verification” by clicking a link.
Once the victim clicks the link/attachment, a remote access tool is installed on that device, possibly without any further notification to the user, and automatically connects to a remote server controlled by the attacker.
At this point, the attacker can access the victim’s device to: (i) steal sensitive data (passwords, financial details, etc.); (ii) monitor user behavior through keylogging and screen recording, and (iii) gain access to anything (e.g., financial and email accounts) the user accesses using the infected device, which can allow the attacker to set up fraudulent money transfers.
How to Protect Yourself from a RAT scam:
- Look for Red Flags:
-
- You received an unexpected, unsolicited or otherwise suspicious email/text containing a link or attachment. Even if the contact information looks correct, DO NOT CLICK the link/attachment or reply to the message unless you are able to verify its source and safety through a known method of communication. For example, if the message purports to be from your bank, call the number on the back of your bank debit card. It’s always better to double-check than to regret.
- You clicked a link or attachment in a seemingly legitimate message that appears to do nothing. Unfortunately, a remote access tool may have been installed with no other notification.
- If your device suddenly displays a blue or black screen and a message like “Do not turn off your computer. Computer is currently being scanned,” this may be a sign that a RAT attack is in progress.***Immediately shut down your device.
- In case of a suspected RAT infection(on any device):
-
- Disconnect from the internet immediately, which prevents the RAT from communicating with the attacker.
- Review and remove any apps you do not recognize. If you are unable to identify and remove the RAT yourself, you may want to contact a cyber security expert. Factory resetting the device may be the best option to ensure complete removal of a RAT.
- Assume all your credentials have been compromised, but do not change them until the RAT is successfully removed. Otherwise, the attacker may be able to discover and leverage your new credentials.
- Additional Ways to Avoid Consequences of a RAT Cyber Attack:
-
- DO NOT CLICK UNKNOWN OR UNSOLICIATED LINKS OR ATTACHMENTS. Be wary of links and attachments forwarded to you.
- Examine sender information. Carefully examine the address(es), URL and spelling used in any correspondence. Scammers use slight differences to trick your eyes and gain your trust.
- Be careful with what information you share online or on social media. Sharing personal information allows scammers to personalize communications to make them seem legitimate.
- Be sure reputable antivirus/anti-malware software is active on each device you use, and keep devices and software updated.
- Remove recently downloaded applications you do not recognize.
- Take advantage of advanced security features, such as multi-factor authentication, and biometrics.
- Add unique, strong passwords to your accounts, and consider the use of a password manager.
- Always verify requests for payment or sensitive information through another trusted method of communication before acting.
- As soon as your session is over, close the browser window you use to access accounts (including Schwab Alliance) and other secure websites.
- To avoid landing on a spoofed website, type the full URL into your browser’s address bar and then add it as a favorite for your convenience later.
- Set alerts to monitor your account activity with real-time notifications. Immediately report any suspicious account activity or unauthorized transactions.
