SectopRATMalware
- 1xxbot
- arechclient
SectopRAT, aka ArechClient2, is a. NET RAT with numerous capabilities including multiple stealth functions. Arechclient2 can profile victim systems, steal information such as browser and crypto-wallet data, and launch a hidden secondary desktop to control browser sessions. Additionally, it has several anti-VM and anti-emulator capabilities.From MISP Galaxy
Last reported 20 days ago, by Help Net Security15 reports
ATT&CK techniques
6 of 87 · each with the sentence it comes from- T1684Social Engineering
“Threat actors are finding success in this specific abuse of Custom GPTs for social engineering and are continuing to rely on this technique.”
- T1036Masquerading
“…with Malicious LNK Lures — The North Korean threat group known as Konni has been observed using ZIP archives with malicious LNK files masquerading as PDF documents as lures in spear-phishing attacks targeting Ukraine-focused individuals and organizations to deliver a malware call…”
- T1053.005Scheduled Task
“…ses a legitimate, Canon-signed application to sideload malicious code, then sets up two persistence mechanisms, a User Run key and a scheduled task, both named Canon Configuration Reader.”
- T1059Command and Scripting Interpreter
“T1059.003Windows Command Shell”
- T1176.001Browser Extensions
“In addition, it targets certain cryptocurrency browser extensions and installed wallet software to steal wallet data.”
- T1553.002Code Signing
“Hardware-Backed Key Protection: Secure code-signing certificates using Hardware Security Modules (HSMs) or vaulting solutions.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
How RMM abuse gives attackers a way in that looks like business as usual“…form case: FakeAgent used a malicious Claude Artifact hosted on the real claude.ai domain to send people looking for Claude Desktop to SectopRAT, hitting 29 organizations in two days.”
-
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses“Figure 4: FakeAgent used a malicious Claude Artifact hosted on the real claude.ai domain to send people looking for Claude Desktop to SectopRAT, hitting 29 organizations in two days.”
-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix“A malicious Claude Artifact impersonated a Claude Desktop download page and redirected victims to SectopRAT malware”
-
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats“SectopRAT Hides Inside Legitimate Application — A new campaign has been observed delivering SectopRAT by concealing it within a legitimate program developed by an Italian digital-audio company.”
-
SectopRAT Returns, Hiding Inside a Legitimate Application“SectopRAT Returns, Hiding Inside a Legitimate Application”
-
Uncovering a SectopRAT Variant Embedded in Legitimate Software“Uncovering a SectopRAT Variant Embedded in Legitimate Software”
-
The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms“…t in reality, targets were redirected to an external domain (downloading-api.it.com), which ultimately led to the download of malware (SectopRAT).”
-
MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer“…atGPT and Grok conversations delivering AMOS Stealer back in 2025, and more recently, a fake Claude Desktop campaign that distributed SectopRAT.”
-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“…er-facing websites: in one case, automotive dealership websites served ClickFix lures leading to the installation of SHADOWLADDER (aka SectopRAT), and in another, eCommerce websites were infected with web skimmers.”
-
Reverse Engineering the Six Stages of MacSync Stealer and RAT“Huntress previously documented cases of AMOS Stealer delivered through poisoned ChatGPT and Grok conversations, and SectopRAT delivered through a fake Claude desktop malvertising campaign.”
-
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT“Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT”
-
Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet“The attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain execution tracker that confirmed each victim compromise in real time.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“…ntrusion began when a user downloaded and executed a malicious file impersonating DeskSoft’s EarthTime application but instead dropped SectopRAT malware.”
-
A Wretch Client: From ClickFix deception to information stealer deployment“In 2025, a notable increase in activity involving ARECHCLIENT2 (SectopRAT) was observed.”
-
GHOSTPULSE haunts victims using defense evasion bag o' tricks“We have observed SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport as final payloads.”
Indicators in its reports
named in the reports above- 85.206.161[.]241in 2 reports
- 107.189.24[.]67in 2 reports
- com[.]applein 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.