The emergence of QuimaRAT shows how malware-as-a-service is making cross-platform remote-access tools easier for criminals to obtain and operate.

QuimaRAT is written in Java, allowing it to target Windows, Linux, and macOS environments where the required Java runtime is available. Its capabilities include remote command execution, file management, screen capture, process control, browser data theft, keylogging, and persistence.

The malware is being sold as a subscription-based platform, meaning attackers no longer need to build their own remote-access trojan. They can simply rent the capability, configure campaigns, and use the tool against victims. Cybercrime, tragically, has discovered recurring revenue.

Its cross-platform nature is particularly concerning for mixed enterprise environments. Organizations often focus endpoint controls heavily on Windows while giving less attention to Linux workstations, macOS devices, developer systems, and servers.

Security teams should monitor for unexpected Java processes, suspicious JAR execution, unusual outbound connections, unauthorized persistence mechanisms, credential access, screenshot capture, and command execution from user directories.

Java should be installed only where there is a genuine business requirement, and execution of unapproved JAR files should be restricted through application control.

The key lesson is that remote-access malware no longer needs to be highly customized to be dangerous. A commercially available, cross-platform RAT can give even lower-skilled attackers access to surveillance, theft, and persistence capabilities across several operating systems.

Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that's capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access. Other subscription tiers include $300 for

Source: New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS via The Hacker News — published 06 Jul 2026.