SecTopRAT bundled in Chrome installer distributed via Google Ads

Malwarebytes documents an active campaign that used fraudulent Google Ads linking to Google Sites to deliver a fake Google Chrome installer which retrieves and decrypts a payload that installs SecTopRAT (a RAT with stealer functionality); the malware injects into MSBuild.exe, disables Defender scanning via a PowerShell exclusion, contacts C2 at 45.141.84.208, and finally installs the legitimate Chrome to avoid suspicion. The blog includes detailed IOCs (malicious sites, filenames, hashes, payload host and C2) and notes that Malwarebytes protections block the ad and detect the payload.