This threat involves a sophisticated malvertising campaign leveraging the legitimate Claude.ai domain to distribute a fake ClaudeDesktop.exe malware implant named SectopRAT. Victims searching for Claude Desktop via Bing ads were redirected to malicious infrastructure hosting the fake executable. SectopRAT employs multiple advanced evasion techniques including VMProtect packing, GPU-based virtual machine detection, and DirectX shader-based payload decryption to hinder analysis. The malware's command-and-control infrastructure uses EtherHiding, storing C2 addresses within Ethereum blockchain transactions to increase resilience against takedown efforts. SectopRAT exfiltrates sensitive data such as credit card details, credentials, browser information, and personal files. The campaign impacted 29 organizations and is connected to previous malicious activity dating to December 2025, with infrastructure linked to known operations such as Operation Endgame and StealC distribution.

The malware exfiltrates sensitive information including credit card data, user credentials, browser data, and personal files, potentially leading to financial loss, identity theft, and further network compromise. The use of advanced anti-analysis and evasion techniques complicates detection and response. The resilient command-and-control infrastructure leveraging the Ethereum blockchain makes disruption and takedown more difficult, prolonging attacker control and data exfiltration capabilities.

No official patch or remediation is available as this is a malware campaign leveraging social engineering and malvertising rather than a software vulnerability. Defenders should educate users to avoid downloading software from unofficial sources or ads, verify software authenticity, and employ endpoint detection solutions capable of identifying SectopRAT and its evasion techniques. Network monitoring for suspicious connections to Ethereum blockchain transactions or known C2 infrastructure may assist detection. Since this is not a cloud service, remediation depends on organizational security controls and user awareness.