SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files

Huntress documented a malvertising campaign ("FakeAgent") that abused a trojanized Claude Desktop installer hosted as a Claude artifact to distribute SectopRAT, a .NET HVNC-capable RAT that steals browser credentials, cookies, payment data and files. The report details sophisticated TTPs—DLL sideloading, blockchain-based 'EtherHiding' C2 rotation, GPU-accelerated AES decryption and robust anti-VM/sandbox checks—provides multiple IOCs (domains, IP, BSC contracts), and notes at least 29 organizations impacted and ~7,100 artifact views prior to takedown.