Researchers discovered a variant of the SectopRAT post-compromise backdoor and infostealer hidden inside legitimate software from an Italian digital-audio company.
The operators appear to have added the remote access Trojan (RAT) after the legitimate application was installed on customer systems rather than by compromising the software vendor itself, Fortinet said in a report this week based on its analysis of the threat. The campaign shows how attackers can exploit the trust that organizations place in widely used applications to gain a foothold in their environments, while sidestepping security scrutiny in the process.
FortiGuard Labs researcher Xiaopeng Zhang, who authored the report, tells Dark Reading there's no evidence the threat actor behind the new SectopRAT campaign specifically targeted the Italian company's software, nor evidence that the adversary exploited a vulnerability in it to hide the malware.
"We believe they used the legitimate application to make the malware look less suspicious. They tampered with the FrameworkBase.dll file to secretly load the SectopRAT payload. SectopRAT has a history of disguising itself as legitimate software, such as the Notion installer and Claude Desktop," Zhang says, pointing to previous campaigns involving the malware.
A Pernicious RAT
SectopRAT, also known as ArechClient2, is a heavily obfuscated .NET-based malware that combines remote-control capabilities with extensive information-stealing functionality, including the theft of browser credentials, cookies, files, and other sensitive data. The RAT first surfaced in early 2019 and has arrived on victim systems via malicious advertising, search engine optimization (SEO) poisoning, ClickFix scams, and fake installers.
For example, in 2025, Elastic Security Labs documented a campaign in which a threat actor used the Ghostpulse malware loader to deliver SectopRAT following a ClickFix social-engineering attack. Elastic reported observing a significant increase in SectopRAT activity during 2025. In 2024, AhnLab reported seeing a threat actor distribute SectopRAT through a fake Notion installer, and more recently Bridewell said it observed an attacker delivering SectopRAT through a Trojanized version of the EarthTime application.
The variant that Fortinet discovered hidden inside a tampered copy of the audio application is another example of a threat actor using legitimate software to hide the malware. The RAT itself, according to Fortinet, was encrypted and embedded in a database file. A legitimate-looking executable and DLL-loading mechanism helped launch the malicious code.