A remote access tool, or RAT, is software that lets an operator control an infected device from a distance. It can provide interactive access such as command execution, file transfer, screen viewing, microphone or webcam access, and persistence on the host.
RATs matter because they turn a single compromise into a hands-on intrusion. Attackers often deliver them through phishing lures, staged scripts, loaders, or trojans that hide the final payload until after the victim opens a file or runs code. Defenders look for unusual outbound connections, suspicious child processes, new startup entries, and repeated beaconing to command-and-control servers. In practice, spotting the delivery chain is often as important as finding the RAT itself.