What is the difference between a stealer and a RAT in a supply chain malware campaign?

Why This Matters for Security Teams

In supply chain malware, the difference is not just what is stolen, but what the malware is designed to do next. A stealer is usually optimized for speed, harvesting browser sessions, saved passwords, tokens, wallet data, or other secrets and sending them out before defenders notice. A RAT changes the risk profile because it provides an interactive foothold that can be reused for discovery, staging, persistence, and follow-on abuse.

That distinction matters because a campaign that starts with secret theft can quickly become an enterprise-wide access problem if the stolen material is valid across code repositories, CI/CD, cloud consoles, or developer tooling. The practical question for defenders is whether the malware is simply draining data, or whether it is also creating an operator-controlled presence that extends the compromise window. The same infected package or plugin can support both outcomes, which makes triage and containment more urgent than label-spotting.

For supply chain attacks specifically, even “stealer-only” activity can be strategically dangerous because the stolen secrets often unlock more systems than the original endpoint. In practice, many security teams discover the real impact only after leaked credentials are used elsewhere, rather than from the initial malware alert.

How It Works in Practice

A stealer typically runs with a narrow mission. It looks for high-value local data, packages it quickly, and exits before the host is fully inspected. In a supply chain campaign, that can mean a compromised dependency, extension, updater, or build artifact is used to collect secrets from developers, runners, or integrators as soon as the malicious code executes.

A RAT is broader and usually noisier, but it gives the attacker more leverage. Once installed, it can accept commands, enumerate the host, pivot to nearby resources, and wait for a better moment to act. That makes the malware useful not only for theft, but for post-compromise operations such as credential dumping, tool installation, lateral movement, and persistence.

Common operational differences include:

• Objective: steal and exfiltrate quickly versus maintain interactive control.
• Time on host: short-lived theft versus longer dwell time.
• Defender visibility: bursty exfiltration versus repeated command activity and suspicious remote control signals.
• Follow-on value: harvested secrets alone versus an ongoing bridge into additional systems.

Supply chain campaigns often blend both approaches. A malicious package may first steal secrets and then use the same access to stage a second payload or check whether the compromise can be extended. The Shai Hulud npm malware campaign is a useful example of supply chain malware focused on secret exposure, while the CircleCI Breach shows how a stolen session token can turn endpoint compromise into broader access to customer secrets and keys.

These controls tend to break down when the infected package runs inside trusted developer or CI/CD environments, because secret stores, cached sessions, and automation credentials make the blast radius much larger than the initial host.

Common Variations and Edge Cases

Tighter classification often increases triage effort, because modern payloads do not stay neatly in one category and may switch between theft, persistence, and remote control inside a single campaign.

Some malware is stealer-first and RAT-second, using the initial harvest to identify where deeper access is worthwhile. Other samples are RAT-first and steal credentials opportunistically once the operator sees a useful target. In supply chain incidents, that hybrid pattern is common because the delivery channel often reaches trusted users, build systems, or developer workstations where both secrets and interactive access are unusually valuable.

There is also a practical distinction between what is stolen and what can be reused. Browser cookies, OAuth tokens, API keys, and cloud access tokens may deliver immediate access even if the malware never behaves like a traditional RAT. Conversely, a RAT without high-value secrets may still be serious because it lets an attacker wait until privileged activity occurs. The deciding factor is whether the campaign produces reusable access, not whether the malware family name sounds more “stealer” or more “remote access.”

Current guidance suggests treating any supply chain payload that can both exfiltrate secrets and accept commands as a combined access incident, because the defensive actions needed for each mode overlap but are not identical.

Risk and Threat Considerations

The main risk is that supply chain malware often turns trusted software delivery into an access path. A stealer creates immediate exposure by copying secrets out of developer endpoints, build agents, or integration tooling, while a RAT can preserve the compromise long enough to abuse those secrets, move laterally, or re-enter the environment after the first alert.

Failure mechanism: attackers exploit the trust placed in packages, plugins, build steps, or updater channels, then use the resulting execution context to harvest credentials or maintain remote control. If the stolen material includes session tokens, cloud keys, or CI/CD credentials, the compromise can extend far beyond the original infected machine.

Impact: defenders may lose both confidentiality and control at the same time. Secrets can be reused against source control, cloud consoles, or internal services, and a RAT can keep the attacker present while response teams are still trying to determine the initial entry point.

Practitioner Guidance

What to prioritise: Treat secret exposure as the immediate containment trigger, even if the payload also appears to be a RAT. If a compromised package or endpoint can access production-adjacent credentials, rotate and revoke before spending time on malware family labeling.

What to verify: Confirm whether the malware had access to browser sessions, token caches, package-signing keys, cloud credentials, or CI/CD secrets. That determines whether the event is a single-host compromise or a broader access incident with downstream blast radius.

What good looks like: Teams can rapidly identify which secrets were present on the host, which of them were valid, and which downstream systems they could reach. They also know whether interactive control persisted beyond the initial exfiltration window.

Practitioner takeaway: In supply chain malware, the classification is useful only if it changes the response, stealer means urgent secret rotation, RAT means urgent containment and persistence hunting, and many real incidents require both.

Related resources from NHI Mgmt Group

• What is the difference between a package supply-chain compromise and a mirror-hosted phishing campaign?
• What is the difference between direct account compromise and SaaS supply chain compromise?
• What is the difference between software supply chain risk and NHI risk?
• What is the difference between SaaS supply chain security and software supply chain security?