SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files

SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files.

The artifact masqueraded as a genuine Claude Desktop installer but redirected victims to claude.ai.download-app[.]us and then to downloading-api.it[.]com/html/claude/win, where a trojanized ClaudeDesktop.exe was served.

Before takedown, the malicious artifact recorded roughly 7,100 views; Anthropic removed it on July 22 following Huntress’ report, but by then the campaign dubbed “FakeAgent” had already achieved broad exposure.

The downloaded ClaudeDesktop.exe was not an official Anthropic binary but a repurposed JetBrains jcef_helper.exe component using Chromium Embedded Framework, chosen specifically for DLL sideloading.

The victims are taken from Bing Search to a public artifact hosted at claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877. Claude indicates in a disclaimer.

This “EtherHiding” technique embedding C2 configuration in blockchain transactions allowed the operators to rotate infrastructure simply by posting new data to the contract, complicating takedown and traditional sinkholing efforts.

Persistence was reinforced via sslconf.exe, a signed IBM SPSS binary abused through another DLL sideloading vector, tempdir.dll, which implemented aggressive anti‑VM and anti‑sandbox checks.

The malware inspected DXGI adapters for known virtualization vendor IDs, checked for sub‑1GB VRAM, and used compute‑shader timing to refuse execution in low‑fidelity analysis environments raising the bar for defenders relying on commodity sandboxes.

Rather than decrypting its payload with CPU‑bound routines, the malware stored appcfg.dat on disk and used a custom DirectX shader (SM5 bytecode).

To perform AES‑256‑CTR decryption on the GPU, effectively sidestepping common hooks on crypto APIs and frustrating standard reverse‑engineering tooling.

Huntress analysts leveraged Claude Opus to extract the DirectX Binary Container (DXBC), reconstruct the embedded Rijndael S‑box, Rcon sequence, and derive key material for the non‑standard AES‑256‑CTR implementation.

A single mis‑transcribed byte in the key initially blocked decryption, underscoring the importance of human‑in‑the‑loop review even in AI‑assisted workflows, but correcting it enabled offline decryption and recovery of both a PE file and an obfuscated .NET assembly.

SectopRAT campaign

Decompilation and string analysis highlighting references to browser logins, cookies, autofill data, credit cards, FTP, Discord and messaging clients tied the payload to the SectopRAT family.

A .NET RAT known for hidden secondary desktops (HVNC), AES‑encrypted C2, and broad credential and data theft functions.malpedia.caad.fkie.

Within the .NET code, Huntress tracked obfuscated HttpClient routines and again found EtherHiding patterns, ultimately recovering the active C2 endpoint at 2.24.131[.]246 and historical C2s embedded in BNB Smart Chain transactions dating back to May 30, 2025.

Huntress said in a report shared with GBhackers, at least 29 organizations compromised after users searched Bing for “Claude desktop app” and clicked a sponsored result that legitimately pointed to a public Claude Artifact hosted on Claude.ai.

Pivoting on WHOIS data and the Validin intelligence platform, analysts linked the email used to register download-app[.]us to at least ten other malware and phishing domains, including polse[.]us, previously seized by Microsoft’s Operation Endgame for hosting StealC infostealer campaigns.

Huntress further correlated the actor with an April 2026 Docker Hub campaign that abused fake Docker Desktop installers and libcef.dll sideloading, suggesting a pattern of abusing trusted developer and AI ecosystems to deliver commodity but heavily protected RATs.

SectopRAT, also tracked as ArechClient2, gives attackers full remote access to victim systems, including the ability to profile hardware and software, exfiltrate browser and crypto‑wallet secrets, hijack sessions via stolen cookies.

In the FakeAgent operation, this translates directly into theft of stored passwords, payment card data, autofill records, session cookies and sensitive corporate documents, enabling rapid account takeover and lateral movement with minimal need for traditional credential harvesting.

For enterprises, the campaign underscores three converging trends: malvertising abuse of AI provider domains, blockchain‑backed resilient C2 via EtherHiding, and the operational reality that advanced GPU‑aware anti‑analysis can now shield commodity RATs from many mainstream defensive tools.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist