Security researchers have discovered a new remote access trojan (RAT) called LabubaRAT that is being spread by disguising itself as legitimate NVIDIA software. When someone downloads what they think is an NVIDIA driver or utility from an unofficial website, they may unknowingly install this malware instead. Once it’s running on a Windows computer, attackers can take full control — watching the screen in real time, copying files, logging keystrokes, and stealing stored passwords.
NVIDIA is one of the most popular graphics card manufacturers in the world, and millions of Windows users regularly search for driver updates online. That popularity makes it an attractive brand for criminals to impersonate. The safest place to get any NVIDIA software is always the official NVIDIA website, and nowhere else.
How to check if you’re affected
Affected devices are any Windows computers where NVIDIA software was recently downloaded from a source other than the official NVIDIA website (nvidia.com). To check:
- Think back to any recent NVIDIA driver or software downloads. If you used a third-party site or a search result instead of going directly to nvidia.com, treat that file as potentially dangerous.
- Run a full scan with your antivirus or Windows Defender to check for hidden threats.
- For future updates, only use nvidia.com/drivers to download NVIDIA software — never click installer links from unverified search results or forums.
If your antivirus flags anything related to NVIDIA software you downloaded from an unofficial source, disconnect from the internet and contact your antivirus provider’s support line.