LabubaRAT: New Rust Malware Poses as NVIDIA Software to Sneak Onto Windows PCs

Key points

• Blackpoint Cyber researchers Sam Decker and Nevan Beal published the first public analysis of a new Rust-based remote access tool they have named LabubaRAT.
• The malware disguises itself as NVIDIA software so it looks harmless on a Windows computer.
• Once installed, LabubaRAT gives the attacker a lasting way back into the machine to run hands-on commands.
• The tool can quietly gather details about the computer it lands on, a step attackers use to plan what to steal next.
• No specific victims, countries or industries have been named in the public write-up so far.

A new piece of malicious software is doing the rounds, and it wears a very familiar costume.

Researchers at Blackpoint Cyber, a security firm, have named it LabubaRAT. It is what analysts call a remote access trojan, or RAT: a program that lets a criminal log into your computer from anywhere in the world as if they were sitting at the keyboard.

The finding was first reported by The Hacker News.

What makes LabubaRAT worth paying attention to is not a clever new trick. It is the disguise.

Why does pretending to be NVIDIA matter?

Because it makes the malware look boring, and boring is safe.

NVIDIA makes the graphics chips inside a huge share of the world's laptops and gaming PCs. Its software updates run quietly in the background on millions of machines. If you saw an NVIDIA-branded file on your computer, you probably would not think twice. Neither would many security tools that scan for anything unusual.

LabubaRAT trades on that trust. The file names and packaging mimic legitimate NVIDIA components so the malware can sit on a system without drawing attention.

What the malware actually does

Blackpoint's Sam Decker and Nevan Beal describe LabubaRAT as a tool built for "hands-on activity." In plain terms, that means a human attacker is meant to log in and steer it directly, rather than just letting it run on autopilot.

Once it is on a machine, LabubaRAT can profile the host. Profiling is the digital version of casing a house: the software notes the computer's name, what user is logged in, what software is installed, and what network it sits on. That information tells the attacker whether the machine is worth robbing, and how.

From there, the attacker has a foothold. They can come and go. They can drop more tools. They can move sideways into other computers on the same office network.

The malware is written in Rust, a modern programming language. That matters mainly for defenders: Rust code can be harder for older antivirus tools to pick apart, and it is becoming a favourite among criminals for exactly that reason.

Should ordinary people be worried?

Probably not on your home laptop, at least not directly.

There is no public evidence yet that LabubaRAT is being spread through mass phishing emails or malicious ads aimed at the general public. Blackpoint's write-up frames it as a tool used in targeted intrusions, the kind aimed at businesses.

That said, the usual advice holds. Download NVIDIA drivers only from nvidia.com or from the update tool built into your PC. Be suspicious of any "NVIDIA update" that arrives as an email attachment, a link in a chat message, or a pop-up on a website. Real driver updates do not work that way.

For company IT teams, the practical takeaway is to watch for files that carry NVIDIA branding but sit in unexpected folders, or that talk to servers no legitimate NVIDIA process would contact.

Blackpoint has not attributed LabubaRAT to a named group, and the researchers stopped short of tying it to a specific campaign. Expect more detail as other vendors pick apart samples in the coming weeks.