Everything you need to know about RAT malware detection and removal

Losing access to or control of your Mac to a malicious actor is what most of us think about when we see the term 'hacker' or 'hacked.' Thankfully, malware that enables that is pretty rare, but it does exist and is known as RAT, or remote access trojan. In this article, we'll tell you everything you need to know about RATs and how to get rid of them.

What is the RAT malware?

RAT stands for remote access trojan. It's a type of malware that allows hackers to access and control a computer or computers on a network. Once they have that control, they can use the computer as if they were sitting in front of it and logged in. If you've ever used software that allows you to access a computer from a different location remotely, or needed a system administrator to log in to your computer from office, you know what we mean.

How did I get a RAT on my computer?

Unlike legitimate remote access tools, RAT malware is downloaded and installed by stealth, without the user's knowledge or permission. Once installed, they circumvent the protection built into the OS, such as Input Monitoring in the Security & Privacy pane of System Preferences, that's designed to prevent unauthorized access. 

However, like most malware, to get onto your Mac in the first place, they have to be downloaded by you. This could be a link you see in an email or website and infect your Mac the moment you click it. This could also be an app bundled with the RAT malware that gets onto your Mac when you install it. 

How do I know if there’s a RAT on my Mac?

You may not know at all. But you may notice it when your Mac starts behaving strangely – some windows are opening although you didn’t open them, the mouse pointer is moving without you even touching your laptop. 

If the activity of the hacker takes place in the background, for example, you won’t notice anything. What’s more, unlike other forms of malware, RATs don’t usually slow down your Mac or impede its performance in different ways. So, it can be either a few signs or even no signs at all that your Mac is infected with the RAT malware. 

What are RATs used for?

As you can imagine, once a hacker has administrative control over your Mac, they can do almost anything they like. Most commonly, RATs are used for the following:

• stealing data
• logging keystrokes to gain access to online accounts
• taking control of a webcam to take pictures
• use your Mac as part of a botnet
• cryptocurrency mining.

As you can imagine, once a hacker has private data or images of you from a webcam, they can use that as part of a ransomware scam. They can also log in to your online account and post on social media on your behalf. That’s pretty scary stuff, and while RATs are pretty rare and you’re unlikely to fall victim to one, the consequences if you do could be pretty dire. 

How to avoid a RAT?

RATs don’t self-replicate, nor exploit vulnerabilities in networks like worms do. They get onto your Mac when you open a RAT malware email attachment, click on a link, visit a website, or download software. So, to avoid getting RAT malware on your Mac, you should follow the same precautions you would in order to avoid any malware:

• don’t click on a link in an email or message unless you are absolutely sure where it leads
• don’t visit a website that your browser warns you it’s unsafe
• keep your browser up to date
• always install security updates for macOS as soon as you can
• don’t respond to scareware and pop-ups that tell you that Flash Player or any other software is out of date or there is a problem with your Mac that needs some special software to fix it
• avoid downloading software from free download sites that use their own download manager.

How to remove RAT malware from your Mac?

If you suspect that your Mac is being controlled remotely, or if it starts behaving strangely, you should scan it with anti-malware software. There are lots of really good anti-malware tools for the Mac, but my favorite is CleanMyMac X. You can set it to protect your Mac automatically by scanning it regularly in the background while you work. You can also run scans manually whenever you want.

CleanMyMac X compares what it finds on your Mac with its database of known malware, and if it finds anything, it allows you to remove it with a couple of clicks. Here’s how to use it.

1. Download, install, and launch CleanMyMac X.
2. To set it to protect your Mac automatically, click on the CleanMyMac X menu, and choose Preferences.
3. Select the Protection tab.
4. Check the box next to real-time protection.
5. Close Preferences.
6. To scan your Mac for malware, choose the Malware Removal module in the sidebar.
7. Press Scan.
8. If CleanMyMac X finds any malware on your Mac, it will tell you what it’s found. If not, it will give you the all-clear.
9. If it finds anything, press Remove to get rid of it.

The good news is that there aren’t that many RATs in use. Most hackers use RATs that already exist, rather than creating their own. That means that anti-malware tools like CleanMyMac X almost certainly knows about the RAT that’s been installed on your Mac, if there is one, and will be able to remove it.

Remote Access Trojans are a type of malware that allows a hacker to take control of your computer. Once they have that control, they can use it to do anything they like, from stealing and deleting files to accessing financial details and even posting on social media on your behalf. However, they are relatively easy to avoid, and you can scan your Mac for them and remove one if it’s there quickly and easily using CleanMyMac X.