The project is based on the V-USB implementation of a low speed USB device.

Using a customized micronucleus bootloader and the TrinketHidCombo library from Adafruit, CorpoRAT simulates a keyboard + mouse HID device. It randomly moves the cursor and tricks the PC into thinking that there is an active user working.

The device can be turned on or off by pressing the NUM, CAPS or SCROLL LOCK keys (selectable in the code, before compiling). When one of these keys is pressed, the activation of corresponding LED is requested by Windows. CorpoRAT monitors these LED statuses and turns on or off based on them. For example, I use SCROLL LOCK to activate the CorpoRAT.

The simulated mouse movement is set to 1 pixel, but this value does not cause any actual movement of the cursor on the screen, meaning that the mouse is completely usable even if the CorpoRAT is active. Even if we cannot see the cursor move on the screen, Windows takes it into account and it is prevented from entering the "inactive user" state and consequently any software installed by your company will also consider you to be active (if it only relies on the AFK status). For example, if your company reports your status on the network based only on the Skype status, then you're on the good path.