Bing ad for NordVPN leads to SecTopRAT

A recent malvertising campaign on Bing impersonated NordVPN using lookalike domains and a malicious ad that redirected users to a convincing fake site offering a direct download. The distributed file (NordVPNSetup.exe) contained both a legitimate installer and a SecTopRAT Remote Access Trojan which injects into MSBuild.exe and connects to a C2 server (45.141.87.216); the report lists malicious domains (nordivpn.xyz, besthord-vpn.com), a SHA256 for the fake installer, and remediation actions taken (reports to providers and Dropbox takedown).