LabubaRAT: New Rust Malware Poses as NVIDIA Software to Sneak Onto Windows PCs

Key points

• Blackpoint Cyber researchers Sam Decker and Nevan Beal published the first public analysis of a new Rust-based remote access tool they have named LabubaRAT.
• The malware disguises itself as NVIDIA software so it looks harmless on a Windows computer.
• Once installed, LabubaRAT gives the attacker a lasting way back into the machine to run hands-on commands.
• The tool can quietly gather details about the computer it lands on, a step attackers use to plan what to steal next.

A new piece of malicious software is doing the rounds, wearing a very familiar costume.

Researchers at Blackpoint Cyber, a security firm, have named it LabubaRAT. It's what analysts call a remote access trojan, or RAT: a program that lets a criminal log into your computer from anywhere in the world as if they were sitting at the keyboard. The finding was first reported by The Hacker News.

Why does pretending to be NVIDIA matter?

Because it makes the malware look boring, and boring is safe.

NVIDIA makes the graphics chips inside a huge share of the world's laptops and gaming PCs. Its software updates run quietly in the background on millions of machines. If you saw an NVIDIA-branded file on your computer, you probably wouldn't think twice. Neither would many security tools scanning for anything unusual.

LabubaRAT trades on that trust. The file names and packaging mimic legitimate NVIDIA components so the malware can sit on a system without drawing attention.

What the malware actually does

Blackpoint's Sam Decker and Nevan Beal describe LabubaRAT as a tool built for "hands-on activity." A human attacker is meant to log in and steer it directly, rather than letting it run on autopilot.

Once on a machine, LabubaRAT can profile the host. Profiling is the digital equivalent of casing a building: the software notes the computer's name, what user is logged in, what software is installed, and what network it sits on. That tells the attacker whether the machine is worth targeting, and how. From there they can drop more tools, or move sideways into other computers on the same office network.

Written in Rust, a modern programming language, LabubaRAT shares that choice with a string of recently documented threats. We reported on Silver Fox's MODBEACON trojan on 10 July 2026, another Rust-built remote-control tool concealed inside fake software installers, and on Gaslight on 25 June, a Rust stealer targeting macOS. Rust code can be harder for older antivirus tools to pick apart, which is why criminals keep reaching for it.

Should ordinary people be worried?

Probably not on your home laptop, at least not directly.

There's no public evidence yet that LabubaRAT is being spread through mass phishing emails or malicious ads aimed at the general public. Blackpoint's write-up frames it as a tool for targeted intrusions aimed at businesses.

Download NVIDIA drivers only from nvidia.com or from your PC's built-in update tool. Be suspicious of any "NVIDIA update" arriving as an email attachment, a chat link, or a website pop-up. Real driver updates don't work that way.

For company IT teams, watch for files carrying NVIDIA branding that sit in unexpected folders, or that contact servers no legitimate NVIDIA process would reach.

Blackpoint hasn't attributed LabubaRAT to a named group and stopped short of tying it to a specific campaign. The detail worth watching for isn't the disguise, which is familiar enough. It's whether samples start appearing in incident reports from named sectors, which would tell us whether this is a targeted instrument or something broader.