What a Malware Subscription Actually Buys

A Telegram advertisement dated 16 February priced a private remote-access tool with a web panel at $500 for one month and $3,000 for life. The lifetime price had been cut from $5,000, yet it still equalled six months of rent. The headline said “FUD software” without any scan result or date (record XT-T009 in the evidence catalogue). Dollar signs here are as written, because the advertisements do not state a denomination.

FUD, short for “fully undetectable”, is the sellers’ word for a file that security products do not flag, but the price ladder above buys something different: time on the tool. Across the crypter, loader, remote access trojan (RAT) and panel advertisements we read, the malware subscription terms sell continued supply of keys, builds, stubs and a panel slot. They rarely sell the detection outcome that the FUD label implies.

On our reading of the advertised terms, the practical result is a split of responsibility, in which the buyer pays for throughput and carries the decay between builds. Private chats may set other terms, and we tested no build. For a defender, that split helps explain why one commodity tool can arrive in a different wrapper each time. For the wider market around these tools, see what cybercriminals were selling in 2025.

Six Advertisements Compared by What the Price Meters

How to read this table. Each row is one dated advertisement, picked to contrast with the others rather than to sample the market. The last two columns are our reading of each text, and a blank is silence in the text, which is not proof that the seller does nothing.

Who Pays When a Build Gets Flagged

The metering suggests where the risk sits. A per-file fee, a daily build cap and a one-day key all price the unit that detection destroys, a single build. A flagged build therefore means another fee, another slot under the cap or another day of key.

There is a competing reading. A per-file price or a daily cap is also the natural unit of a seller’s labour and server capacity, so metering alone does not show that detection is being priced. The cadence statements favour the decay reading, because a seller rationing only capacity would have less reason to promise daily stubs (XT-T011) or daily updates (XT-T024).

XT-T021 shows the buyer’s side of the arithmetic. At $50 a crypt the ninth job makes the monthly plan cheaper, so the published price list effectively tells a heavy re-crypter to choose the unlimited subscription. The advertisement never explains why anyone would need that many crypts.

The closest thing to an outcome guarantee is a trial. XT-T019 offers a one-time free test in which the buyer sends a raw payload, receives a private build and pays only if satisfied. That tests one build before purchase and says nothing about the build in week three.

What Sellers Put in Writing

Our strict base is 169 direct and service offers, but 48 of them are one reposted Turkish bundle advertisement that carries almost no seller terms. We therefore report shares on the other 121 offers. They are 44 bundles, 38 RATs, 18 crypters, 6 C2 or botnet panels, 6 AV-bypass services, 5 loaders and 4 obfuscators or packers. Across all 169 the shares are lower, for example 19.5% for a FUD claim and 10.1% for support.

Across the 121, relatively few offers put any seller obligation into writing. Escrow is payment protection rather than a seller obligation, and it is mentioned slightly more often than support.

• Support is stated in 16 offers (13.2%), and updates in 12 offers (9.9%).
• Hosting of a server or panel is stated in 3 offers (2.5%).
• Rebuild or re-masking after detection is stated in 5 offers (4.1%).
• Refund, replacement or warranty is stated in 1 offer (0.8%).
• Escrow is mentioned in 19 offers (15.7%).

Rebuild and refund terms matter particularly for the evasion products, so we count those separately. Among the 29 crypter, loader and AV-bypass offers, 2 state a rebuild, 1 states a refund or warranty, and 18 make a FUD or undetectable claim. A FUD or undetectable claim appears in 33 of the 121 offers (27.3%).

Only one of the 33 gives a window in days: XT-T023, on 29 June, claims three days of validity with no start date or test. Three more quote scan scores without a test date, such as “0 of 42” in XT-T011.

One advertisement is unusually frank, although it sits outside the strict count. On 22 August a phishing overlay tool (XT-T026) says only that one named Windows product did not flag it at launch and that other products were not checked. Most claims are absolute instead: a 25 October panel advertisement promises output that bypasses “all Windows security”, with no test and no duration (XT-T034).

Warranty language is rarer still, since a 20 July forum crypter advertisement offers a one-month warranty and daily updates but names no redress process (XT-T024).

What a Lifetime Licence Tells Us

Six catalogue advertisements state both a monthly and a lifetime price. Dividing each lifetime price by the monthly price in that same advertisement gives ratios from 1.8 to 6.0. Each ratio keeps its own advertised terms; the amounts are not pooled into a common price or denomination cohort. One interpretation is that the seller expects a build to stay useful for only a few months, so “forever” is priced as a few months of rent.

Another reading is cash flow, since an up-front payment helps a seller whatever the product life, and the ratios cannot separate the two explanations.

Two advertisements point the same way. In XT-T029 the RAT is sold for life but only six months of crypter come with it. A February forum seller (XT-T010) declines to sell lifetime access yet, citing the need to deliver the promised quality, so both advertisements treat upkeep as the commercial risk.

Managed Versions Sell the Maintenance

A few advertisements make upkeep the product, and a 30 May changelog (XT-T020) reads as a maintenance contract, with refreshed evasion for named commodity tools. XT-T005 bundles hosting and a month of FUD service into its package. A mobile exploitation framework, XT-T016, promises a four-hour hotfix, but it belongs to the exploit side of this chapter and is not counted here.

The sample cannot show whether managed advertisements cost more, because no pair of records prices the same tool both ways and a premium cannot be computed. The managed pitch is visible, but its price effect is not established.

Does the Ad Format Hide the Real Terms?

The strongest objection concerns format, because a Telegram advertisement is short, with a median of about 633 characters among strict offers. Some sellers acknowledge as much: XT-T025 offers custom durations by direct message, and XT-T014 leaves other prices to direct messages. Refund and rebuild terms may be agreed in private chats or vetted channels that our collection does not see.

The objection is fair, and the evidence cannot rule it out, but two points limit it. First, 65 of the 121 offers (53.7%) name no commercial unit at all, so the public advertisement often omits even the price basis.

Second, the one dispute we hold, a forum thread (XT-T012), shows the gap in action. The seller says the terms were in the sales thread and that files need re-masking every few days unless signed. The buyer says builds were flagged within 48 hours and that no limits or refund text existed at purchase. Neither account has been verified.

So the claim is narrower than “sellers never offer remedies”. Public advertisements sell supply, and the sellers who write remedies down are a small minority. A larger sample with stated refund or rebuild terms above roughly 10% would weaken our reading.

What Frequent Re-Crypting Means for Detection

Several advertisements price or promise short rebuild cycles: XT-T011 states fresh stubs daily on a RAT-and-crypter pair, and XT-T024 promises daily updates. XT-T008 caps builds at two or five a day, and the XT-T012 seller says files need re-masking every few days. We tested no product, so these are advertised cadences rather than measured ones.

Still, they support a simple inference for incident response. A commodity RAT found in an intrusion may sit in a wrapper built for one buyer, so its file hash and packer traits say very little regarding the next investigation. Wrapper and payload are also sold separately. XT-T031 offers a crypter at a 50% discount to subscribers of a named RAT, although the record does not identify who sells either product.

The primary sources point the same way. MITRE ATT&CK T1027, Obfuscated Files or Information, covers packing and polymorphic code, and its detection guidance favours behaviour over specific signatures. T1588.001 lists buying malware as an adversary capability, and Microsoft’s documentation on behavioral blocking and containment describes stopping threats by their behaviours and process trees.

For detection engineering, that favours rules on what the tool does once it runs, such as persistence, command-and-control traffic and process chains, over rules on one build. It also means a shared wrapper does not by itself tie two incidents together. The same logic applies upstream, because our EDR killer price comparison shows what sellers charge to disable the agent that would catch the behaviour.

The wider context is in the Brandefense Cybercrime Report 2026. A parallel study of service terms in another crime area is who does the technical work in phishing service advertisements. For background, see our glossary entries on malware as a service and command and control.

Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.

Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.

Brandefense analysts reviewed and approved the findings.