SectopRAT

malware · malware:sectoprat

Information stealer and remote-access tool with hands-on-keyboard capability, delivered by the FakeAgent malvertising campaign through DLL side-loading under signed third-party binaries. Huntress documents plaintext strings referencing browser logins, cookies, autofills and credit cards, and command-and-control data stored in the Ethereum blockchain, the takedown-resistant technique known as EtherHiding (Huntress, 2026-07-22; BleepingComputer, 2026-07-23).

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

used by

• FakeAgent
  campaigncampaign:fakeagentevidence · 2026-07-26
  BleepingComputer names SectopRAT as the payload the FakeAgent installer delivers.

Story timeline

Every entry that names SectopRAT, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

1. 2026-07-26FakeAgent, malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading
   mentionactive-threatsA search ad pointed at a legitimate vendor domain: the lure page was a user-created artifact on the platform itself

Entries about SectopRAT

No published entry is about this entity yet · the story timeline above lists the entries that mention it.

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

• FakeAgent×1
  campaigncampaign:fakeagentlinked