A laughing RAT: CrystalX combines spyware, stealer, and prankware features

Kaspersky Securelist batch covering multiple high-risk trends and campaigns: a new CrystalX RAT offered as MaaS that combines spyware, stealer and so-called prankware; a supply‑chain compromise of the LiteLLM AI gateway enabling data theft; the Coruna exploit kit (updated Operation Triangulation) leveraging iOS kernel exploits; and several active malware families and campaigns — Horabot (targeting Mexico), GoPix (memory‑only Brazilian banking Trojan using PAC files and malvertising), BeatBanker (dual‑mode Android crypto‑miner and banker), and Arkanix stealer (C++/Python MaaS). Also included: Q