A campaign uses fake Microsoft Store product pages to trick Windows users into installing legitimate remote-management software.
Attackers then use that access to deploy AgtaBackup RAT, a custom .NET malware strain that can steal browser data, record keystrokes, capture screens, and run commands without the user seeing them.
Palo Alto Networks Unit 42 reported the campaign on September 28. The attack starts with a page advertising popular video-conferencing software.
It looks like a Microsoft Store listing, but its download delivers a genuinely signed remote monitoring and management (RMM) installer, such as LogMeIn Resolve or ConnectWise ScreenConnect, rather than the promised application.
Fake Microsoft Store Spreads RAT
The victim sees a normal installer and a Windows User Account Control (UAC) prompt. If they approve it, the RMM service enrolls the PC in an attacker-controlled account. Its traffic goes to the RMM vendor’s legitimate cloud service, which can make the access look routine.
Hours or days later, the attacker opens a remote terminal through that RMM connection. A PowerShell command downloads AgtaBackupAgent.msi from attacker-controlled infrastructure and installs it silently.
The RAT lands under C:\Program Files\Agta Backup\ as Credential Guard.exe, a name chosen to resemble a Windows security component. It runs as a hidden SYSTEM service called AgtaBackupAgentSvc.
AgtaBackup RAT checks in with its command-and-control server every two seconds and opens a WebSocket connection for live instructions.
It sends device details, including the hostname, operating system, active user, and installed antivirus product. Its operators can execute PowerShell, move files, take screenshots, and install further software.
The malware collects credentials, cookies, and other profile data from Chrome, Edge, Firefox, and several other browsers. A separate program, Window Security Health Services.exe, records keystrokes.
Another feature creates an AgtaBackstage desktop, where attackers can run an interactive command shell hidden from the logged-in user.
The RAT can also change a Windows setting that moves UAC prompts off the secure desktop, allowing remote input to interact with them.
Two scheduled tasks, AgtaBackupAgentWatchdog and AgtaBackupAgentGuardian, check the installation every minute and at startup.
They can restore the RAT if its service stops or its files are removed. The service also restricts access to its configuration, making it harder for administrators to inspect, github said.
Defenders should investigate unexpected RMM enrollment, especially when an RMM process leads to a PowerShell download of an MSI and a quiet msiexec installation.
Other useful signs include the two scheduled tasks, the AGENT_CHECKIN_URL machine variable, requests to /api/agents/checkin, and an unsigned SYSTEM process reading multiple browser credential files.
Those behaviors are more useful for hunting than the fake Store page alone: the RMM installer may be legitimate, but its enrollment gives the attacker control.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
