🕵️ SectopRAT

The items that name it 6

• Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
  article2026-10-01

  Delivered via the FakeAgent campaign's fake Claude Desktop client hosted on claude.ai

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeup2026-09-28

  Prior campaign: a malicious Claude Artifact impersonated a Claude Desktop download page and redirected victims to SectopRAT malware.

• The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
  writeup2026-08-27

  Malware delivered via the FakeAgent Claude Artifact malvertising campaign

• MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  writeup2026-08-17

  RAT previously distributed via a fake Claude Desktop campaign observed by Huntress.

• Reverse Engineering the Six Stages of MacSync Stealer and RAT
  writeup2026-07-29

  Referenced as previously documented by Huntress, delivered through a fake Claude desktop malvertising campaign.

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
  writeup2026-07-22

  Remote access trojan (RAT) that siphons off user credit card data, personal information, files, and passwords; attribution updated to this family due to presence of HVNC in the .NET payload. Delivered as the secondary component via the decrypted appcfg.dat payload.