Reported by 2 outlets
SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
SectopRAT (also called ArechClient2) is a .NET remote access trojan that can steal passwords, saved payment cards, browser cookies, and cryptocurrency wallet data while giving attackers remote control over an infected Windows device. In this campaign, attackers concealed the encrypted payload inside a legitimate digital audio workstation folder under C:\ProgramData, outside its normal installation path, rather than distributing a trojanized vendor build. Researchers found no evidence of a confirmed supply-chain compromise. The infection chain starts with a legitimate executable, ReportDump.exe, configured to run through Windows Task Scheduler; it loads FrameworkBase.dll, which attackers modified in its Import Address Table to load sdkcra.dll. That DLL reads encrypted assembly code from Activation.Desktop.db, passes it through stp_aim_x64_vc15.dll, and abuses EnumSystemCodePagesW() to execute the payload.
The key defensive insight is that this is software tampering at the endpoint, not a supply-chain event: attackers placed a modified folder in C:\ProgramData and used a legitimate executable as the loader. That means any endpoint with the altered software folder is at risk regardless of whether the original vendor package was clean. The malware targets high-value data including browser credentials and crypto wallets, making infected devices valuable for both direct theft and follow-on attacks.
Defenders should hunt for the specific persistence and payload indicators: unexpected folders under C:\ProgramData containing audio workstation components, the files FrameworkBase.dll, sdkcra.dll, and Activation.Desktop.db in unexpected locations, and scheduled tasks referencing ReportDump.exe. Check process creation from those paths and inspect network connections from the resulting payload. Monitor for additional campaigns that reuse the same DLL-loading technique against other legitimate software packages.
Timeline
-
original reporting
SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
gbhackers.com · 13d ago · September 30th, 2026
A newly analyzed SectopRAT campaign demonstrates how threat actors can weaponize trusted application components to conceal a full-featured remote access trojan and steal high-value data. The investigation found no evidence that the software vendor distributed a trojanized build or that the incident stemmed from a supply-chain compromise. Instead, attackers appear to have modified an existing […] The post SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Malware Hidden in Legitimate Software Can Steal Passwords, Cards and Crypto Wallets
cyberpress.org · 13d ago · September 30th, 2026
FortiGuard Incident Response researchers investigated an intrusion in which attackers concealed SectopRAT inside a legitimate software folder. The malware can steal passwords, saved payment cards, browser cookies, and cryptocurrency wallet data while giving attackers remote control over an infected Windows device. SectopRAT, also called ArechClient2, is a .NET remote access trojan. In this incident, attackers hid its encrypted payload alongside components of a digital audio workstation developed by an Italian company. Researchers found the altered software folder under C:\ProgramData , outside its normal installation location. They found no evidence that the vendor distributed compromised software, making this a case of software tampering rather than a confirmed supply chain attack. Trusted Software Hides Infostealer The infection chain starts with ReportDump.exe , a legitimate software component configured to run automatically through Windows Task Scheduler. When launched, the executable loads FrameworkBase.dll . Attackers modified this library’s Import Address Table to make it load another file, sdkcra.dll , which starts the malicious loading process. The SectopRAT payload is hidden in a legitimate software folder (Source: fortinet) The malicious DLL reads encrypted assembly code from Activation.Desktop.db . After decryption, it passes the code to an exported function in stp_aim_x64_vc15.dll . That function abuses the Windows EnumSystemCodePagesW() API by supplying the decr