Kaspersky Global Research & Analysis Team (GReAT) has uncovered an active malicious campaign distributing a previously undocumented RAT with a very broad feature set. Beyond the standard remote access trojan functionality, it combines stealer, keylogger, clipper, and spyware capabilities.

Cybercriminals are selling it to third parties as MaaS (malware-as-a-service) promoting it on YouTube and Telegram, increasing the likelihood of its use across a wider range of actors, including less-skilled operators.

Due to its stealer functionality, the malware can collect a wide range of data about its victim: it gathers system information, extracts credentials for Steam, Discord and Telegram, and also harvests data from web browsers. It also poses a threat to cryptocurrency users, as it includes a browser-based clipper that replaces crypto wallet addresses.

Beyond data theft, CrystalX RAT is capable of full-scale surveillance, with the ability to take screenshots, record audio from the microphone, and capture video from both the webcam and the victim’s screen.

Particularly notable is the CrystalX RAT “playful” Prankware feature set, which is actively promoted by the developers. These capabilities allow operators to visibly interfere with the victim’s system by shaking the mouse cursor, setting wallpapers on the victim’s screen, changing screen orientation, hiding desktop icons, forcing system shut downs, and even delivering real-time pop-up notifications and messages to the victim.

While seemingly trivial, these features introduce a disruptive and psychological dimension to the attack, making the attack both visible and distressing for the victim.

Kaspersky reports attacks targeting users in Russia, but the trojan has the potential to spread to other countries due to its sales and distribution model.

“Such a diverse feature set effectively enables a 360-degree compromise of the victim and a complete loss of privacy. Beyond gaining access to account credentials, the stolen data could potentially be used for blackmail.

“At the moment, the initial infection vector is not precisely known, but it is already affecting dozens of victims. Our telemetry is already detecting new versions of the implants, indicating that this malware is still actively developed and maintained.

“We expect the number of victims to grow significantly and its geographic spread to expand in the near future,” says Leonid Bezvershenko, senior security researcher at Kaspersky GReAT.

Microsoft has rolled out a new set of features for its Microsoft 365 Copilot platform, including tools for complex, multi-step work and deeper research tasks, as competition in workplace artificial intelligence (AI) intensifies.

The update introduces Copilot Cowork, a capability aimed at handling long-running tasks across Microsoft 365 applications.

The feature is being made available through the company’s Frontier programme, which typically gives early access to experimental tools.

Microsoft is also integrating technology linked to Claude – an AI model developed by Anthropic –into Copilot, signalling a broader shift toward using multiple AI systems within a single product rather than relying on a single model.

Jared Spataro, chief marketing officer for AI at Work at Microsoft, says the company is positioning Copilot as a system embedded directly into workplace software, rather than a standalone tool.

“Microsoft 365 Copilot is your AI for work,” he says, adding that it draws on multiple AI models and is integrated into existing workflows.

Alongside this, Microsoft has upgraded its Researcher feature, which is designed to analyse information from multiple sources and generate structured reports.

A new “Critique” function separates the drafting and review process between different AI models – one generates an initial response, while another evaluates and refines it.

The company says this approach improves output quality, with Researcher showing gains on its internal benchmark for accuracy, completeness and objectivity.

Another addition, called Model Council, allows users to compare outputs from different AI models side-by-side, highlighting differences in responses and reasoning.

The updates form part of what Microsoft calls “Wave 3” of Copilot, as it pushes to embed generative AI deeper into enterprise software. The move reflects a wider industry trend towards combining models from multiple providers, including OpenAI and Anthropic, to improve performance and reliability.

Dangote Petroleum Refinery and Petrochemicals (DPRP) has debunked recent circulation of unauthorised information regarding a potential Initial Public Offering (IPO).

In a statement, DPRP noted that several online platforms and unofficial sources have published unverified, and in some instances inaccurate, information relating to a potential offering.

“Such reports do not originate from DPRP and should be treated with caution. All official updates regarding any potential transaction will be communicated strictly through DPRP’s formal public disclosures and announcements issued by its appointed advisers, in line with applicable laws and regulatory requirements.

“Accordingly, the public, investors, and all market participants are strongly advised to disregard speculative commentary and rely solely on verified information formally issued by DPRP or its authorised representatives,” the statement said.

The firm assured stakeholders that, when appropriate, comprehensive, and accurate details regarding any proposed transaction will be made available through official channels, including regulatory filings, authorised press releases, and coordinated communications by the Enterprise and its appointed advisers.