The file is sent via phishing emails. If opened, it installs a hidden file at C:\Users\ToxicEye\rat.exe .
Watch for unusual traffic to Telegram servers from devices that do not have the app installed. ToxicEye.rar
The malware grants attackers nearly full control over a victim's machine: The file is sent via phishing emails
The malware communicates back to the attacker via the Telegram API, which often bypasses enterprise security because Telegram is seen as a "trusted" service. Signs of Infection & Protection ToxicEye.rar
Terminate active processes and take over the Task Manager.