Fortinet found SectopRAT hidden in tampered Italian audio software, using DLL tampering, scheduled tasks, and in-memory loading for remote control and credential theft.
SectopRAT hides in tampered legitimate software and steals browser credentials and crypto wallets.
SectopRAT has resurfaced, hiding inside legitimate applications to evade trust-based defenses.
Huntress details campaigns abusing Claude Artifacts, claude.ai/share links, and ChatGPT/Grok conversations to deliver SectopRAT, MacSync, and AMOS stealers.