Telegram-Based Millenium RAT Campaign Infects 60,000 Devices

Group-IB researchers report that Millenium RAT, a Telegram Bot API–controlled remote access trojan rewritten in native C++, has infected approximately 62,289 Windows systems worldwide (39,730 in Q1 2026). Sold cheaply as malware-as-a-service by an actor known as ShinyEnigma and attributed to the Y2K Operators, the RAT steals browser data, logs keystrokes, captures screenshots and audio, can download and run additional payloads (and includes some file-encrypting commands), and spreads via social-engineered booby-trapped downloads and backdoored tools.